Sign in

v1

latestOpenAPI 3.0.32026-07-26172157253.6 KB
Client

Exchange OAuth code for tokens (PKCE)

Exchange the insforge_code (received from OAuth callback) for access and refresh tokens.

This endpoint is used for PKCE flow in mobile/desktop/server clients:

  1. After OAuth callback, your redirect_uri receives insforge_code parameter
  2. Call this endpoint with the code and your original code_verifier
  3. Receive access token and refresh token in response

The code_verifier must match the code_challenge sent during OAuth initiation.

post/api/auth/oauth/exchange

Query parameters

client_type'web' | 'mobile' | 'desktop' | 'server'

Client type determines how refresh tokens are returned:

  • web: Refresh token stored in httpOnly cookie, csrfToken returned in response
  • mobile/desktop/server: refreshToken returned directly in response body

Request body

codestring required

The insforge_code received from OAuth callback redirect

code_verifierstring required

The original code_verifier used to generate code_challenge. Must be 43-128 characters, using [A-Za-z0-9-._~]

Example request

{
  "code": "abc123...",
  "code_verifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
}

Response

Tokens exchanged successfully

accessTokenstring

JWT access token for API authentication

refreshTokenstring

Refresh token for obtaining new access tokens