---
title: "Exchange a one-use authorization code with PKCE"
method: POST
path: "/cis2/token"
tags: ["Staff Identity"]
---

# Exchange a one-use authorization code with PKCE

`POST /cis2/token`

## Request

- Base URL: `https://sim.animahealth.com`
- URL: `https://sim.animahealth.com/cis2/token`
- Auth: none required

Public client; no client secret or refresh token. Wrong verifier consumes the code. Returns opaque access token plus RS256 ID token and sets a staff-session cookie. Tokens cannot authenticate service APIs.

## Request body `application/x-www-form-urlencoded`

- object
  - `grant_type` 'authorization_code', required
  - `client_id` string, required
  - `redirect_uri` string, uri, required
  - `code` string, required
  - `code_verifier` string, required

## Response `200`

Success

- object
  - `access_token` string, required
  - `id_token` string, required
  - `token_type` 'Bearer', required
  - `expires_in` integer, required
  - `scope` string, required

## Other responses

- `400`: Invalid input or unsupported workflow
- `401`: Missing or invalid credentials
- `403`: Scope, origin or operator restriction
- `404`: Unknown resource
- `409`: Stale version, invalid transition or unavailable capacity
- `413`: Request exceeds this operation's body-size limit
- `429`: Deployment has reached its 5,000-team capacity
- `500`: Internal simulation error

---

[API](https://skmtc.dev/animahealth/apis/nhs-sim-api.md) - [All operations](https://skmtc.dev/animahealth/apis/nhs-sim-api/llms.txt) - [OpenAPI document](https://skmtc.dev/animahealth/apis/nhs-sim-api/revisions/c7803d7a3e58?raw)