---
title: "Exchange authentication code for tokens"
method: POST
path: "/v1/authentication/access-token"
tags: ["Authentication Controller"]
---

# Exchange authentication code for tokens

`POST /v1/authentication/access-token`

Exchanges a valid authentication code for access and refresh tokens. The code is single-use and will be invalidated after this call.

## Request body

- CodeBean — Authentication code and device token
  - `code` string
  - `deviceToken` string
  - `redirectHost` string
  - `platformType` string

## Response `200`

Tokens generated successfully

- TokenBean
  - `authToken` string
  - `refreshToken` string
  - `userId` string
  - `platformType` string

## Other responses

- `400` — Invalid request parameters
- `401` — Invalid or expired code
- `409` — User is already at the parallel-session limit. Response body shape: `{"error": "...", "code": "<uuid>"}`. The FE forwards `code` to `GET /v1/authentication/logout-all-devices?code={code}&device_token={device_token}` to clear all existing sessions, then retries this access-token exchange.
- `500` — Internal server error

---

[API](https://skmtc.dev/floik/apis/floik-authentication-server.md) · [All operations](https://skmtc.dev/floik/apis/floik-authentication-server/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/floik/floik-authentication-server/revisions/2b2a5dad2f5e/schema)