---
title: "Token exchange"
method: POST
path: "/v2/oauth/token"
tags: ["oauth"]
---

# Token exchange

`POST /v2/oauth/token`

Exchange auth code for access token as part of sgID authorization code flow

## Request body

- TokenExchangeRequestBodyV2
  - `client_id` string, required — sgID client ID which was provided to you during client registration
  - `client_secret` string, required — sgID client secret which was provided to you during client registration
  - `code` string, required — Authorization code that was received from the callback URL after the user authenticates with Singpass
  - `grant_type` string, required — This field must take the value `authorization_code` as sgID only supports the OAuth 2.0 authorization code flow
  - `code_verifier` string, required — A cryptographically random string that was used to generate your code challenge in the authorization request

## Response `200`

Successful token exchange

- TokenExchangeSuccess
  - `access_token` string — Access Token to be used with retrieving the encrypted payload from user info endpoint
  - `id_token` string — JWT token with the associated user claims. Encodes the following: - iss (hostname) - sub (end user's unique identifier) - aud (client id) - nonce (only returned if provided in authorization url) - exp (seconds before auth request and access token expires) - iat (timestamp at which id token was issued)

## Other responses

- `400` — Invalid request due to one of the following errors: - Invalid grant type - Missing parameters in the request body (`client_id`, `client_secret`, `redirect_uri`, or `code`) - Invalid grant (auth code is expired or invalid, or redirect_uri does not match
- `401` — Invalid client credentials
- `500` — Server error

---

[API](https://skmtc.net/sgid/apis/sgid-api.md) · [All operations](https://skmtc.net/sgid/apis/sgid-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sgid/sgid-api/revisions/6db43b35bc50/schema)