---
title: "Exchange OAuth code for tokens (PKCE)"
method: POST
path: "/api/auth/oauth/exchange"
tags: ["Client"]
---

# Exchange OAuth code for tokens (PKCE)

`POST /api/auth/oauth/exchange`

Exchange the insforge_code (received from OAuth callback) for access and refresh tokens.

This endpoint is used for PKCE flow in mobile/desktop/server clients:
1. After OAuth callback, your redirect_uri receives `insforge_code` parameter
2. Call this endpoint with the code and your original code_verifier
3. Receive access token and refresh token in response

The code_verifier must match the code_challenge sent during OAuth initiation.

## Query parameters

- `client_type` 'web' | 'mobile' | 'desktop' | 'server'

## Request body

- object
  - `code` string, required — The insforge_code received from OAuth callback redirect
  - `code_verifier` string, required — The original code_verifier used to generate code_challenge. Must be 43-128 characters, using [A-Za-z0-9-._~]

## Response `200`

Tokens exchanged successfully

- object
  - `user` UserResponse
    - `id` string, uuid
    - `email` string, email
    - `profile` object, nullable — User profile data (name, avatar_url, and custom fields)
      - `name` string
      - `avatar_url` string, uri
    - `metadata` object, nullable — System metadata (device ID, login IP, etc.)
    - `emailVerified` boolean
    - `providers` string[]
    - `createdAt` string, date-time
    - `updatedAt` string, date-time
  - `accessToken` string — JWT access token for API authentication
  - `refreshToken` string — Refresh token for obtaining new access tokens

## Other responses

- `400` — Invalid request - missing code or code_verifier
- `401` — Invalid or expired code, or code_verifier mismatch

---

[API](https://skmtc.net/insforge/apis/insforge-authentication-api.md) · [All operations](https://skmtc.net/insforge/apis/insforge-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/insforge/insforge-authentication-api/versions/a935bb49f932/schema)