1. Docs
  2. API Reference
  3. OAuth2 token exchange

OAuth2 token exchange

POST/oauth/token

OAuth2 token endpoint (POST /oauth/token). Supports two grants: authorization_code (requires code, redirect_uri, and code_verifier, validates the confidential client's client_secret and the PKCE S256 challenge, enforces single-use of the code and active Environment membership, then returns access_token, id_token, token_type, expires_in, and a rotating refresh_token) and refresh_token (requires refresh_token, client_id, and client_secret). Errors are returned in OAuth form — invalid_request, invalid_grant, or unsupported_grant_type — with a 400 status.

Request body

application/json

grant_typestring Required
codestring Optional
client_idstring Required
client_secretstring Required
redirect_uristring Optional
code_verifierstring Optional
refresh_tokenstring Optional

Responses

200
Request
curl -X POST "https://auth.canopy-io.com/oauth/token" \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "string",
    "code": "string",
    "client_id": "string",
    "client_secret": "string",
    "redirect_uri": "string",
    "code_verifier": "string",
    "refresh_token": "string"
  }'
Response
HTTP/1.1 200

(empty body)
 Related endpoints Was this page helpful?

Tell us how we can improve this guide.

Canopy