---
title: "Exchange an Authorization Code"
method: POST
path: "/token"
tags: ["Auth"]
---

# Exchange an Authorization Code

`POST /token`

This endpoint is the final step in our [📖 OAuth Authentication Flow](/docs/authorizing-with-oauth2).

Use this endpoint to exchange an **Authorization Code** for a **User Access Token**, which can be used to access the rest of this API.

To ensure that your application does not retain unnecessary access to user data, [revoke](./delete_token) this access token in the event that is no longer required (e.g. the user deletes their account).

**Endpoint not applicable for Personal Apps**. See our [📚 Getting started guide](/docs/getting-started) to set up your Personal App.

> 📘
>
> **OAuth2 Error Responses**
>
> In keeping with the OAuth2 specification, error responses from this endpoint contain an error in the `error` field, rather than the `message` field used by other Akahu endpoints.

For more details see:
- [📚 OAuth Authentication Flow](/docs/authorizing-with-oauth2).
- [📖 Auth scopes](/docs/scopes)
- [📖 Token webhooks](/docs/reference-webhooks#token)
- [📚 Accessing transactional data guide](/docs/accessing-transactional-data)
- [📚 Accessing account data guide](/docs/accessing-account-data)

## Request body

- object
  - `grant_type` string, required — Must always be `authorization_code`
  - `code` string, required — The code to be exchanged for a **User Access Token**, received upon the user's completion of the authorization redirect flow.
  - `redirect_uri` string, required — Same `redirect_uri` you specified to start the OAuth flow to receive an exchange code.
  - `client_id` string, required — Your Akahu **App ID Token**
  - `client_secret` string, required — Your Akahu **App Secret**

## Response `200`

Successful response.

- Token — Granted token details
  - `success` boolean
  - `access_token` string — Authorised **User Access Token** used to authenticate the user upon additional resource request.
  - `token_type` string — Type of authentication
  - `scope` string — whitespace separated string specifying the granted permissions and resources the given token has access to.

## Other responses

- `400` — Your request was malformed or otherwise unacceptable. The `error` key in the response will be on one of the standard OAuth error codes.
- `500` — Internal Error

---

[API](https://skmtc.dev/akahu/apis/akahu-enduring-api.md) · [All operations](https://skmtc.dev/akahu/apis/akahu-enduring-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/akahu/akahu-enduring-api/revisions/b2de9915920d/schema)