---
title: "SSO Token Exchange"
method: POST
path: "/v1/integrations/sso/token"
tags: ["authentication", "marketplace"]
---

# SSO Token Exchange

`POST /v1/integrations/sso/token`

During the autorization process, Vercel sends the user to the provider [redirectLoginUrl](https://vercel.com/docs/integrations/create-integration/submit-integration#redirect-login-url), that includes the OAuth authorization `code` parameter. The provider then calls the SSO Token Exchange endpoint with the sent code and receives the OIDC token. They log the user in based on this token and redirects the user back to the Vercel account using deep-link parameters included the redirectLoginUrl. Providers should not persist the returned `id_token` in a database since the token will expire. See [**Authentication with SSO**](https://vercel.com/docs/integrations/create-integration/marketplace-api#authentication-with-sso) for more details.

## Request body

- union
  - object
    - `code` string, required — The sensitive code received from Vercel
    - `state` string — The state received from the initialization request
    - `client_id` string, required — The integration client id
    - `client_secret` string, required — The integration client secret
    - `redirect_uri` string — The integration redirect URI
    - `grant_type` 'authorization_code', required — The grant type, when using x-www-form-urlencoded content type
  - object
    - `refresh_token` string, required — The refresh token received from previous token exchange
    - `client_id` string, required — The integration client id
    - `client_secret` string, required — The integration client secret
    - `grant_type` 'refresh_token', required — The grant type, when using x-www-form-urlencoded content type

## Response `200`

- union
  - object
    - `id_token` string, required
    - `token_type` string, nullable, required
    - `expires_in` number
    - `access_token` string, nullable, required
    - `refresh_token` string
  - object
    - `id_token` string, required
    - `token_type` string, required
    - `access_token` string, required
    - `refresh_token` string, required
    - `expires_in` number, required

## Other responses

- `400` — One of the provided values in the request body is invalid.
- `403`
- `500`

---

[API](https://skmtc.net/vercel/apis/api.md) · [All operations](https://skmtc.net/vercel/apis/api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vercel/api/versions/61d1ba3f6dac/schema)