---
title: "OAuth Token Exchange"
method: POST
path: "/api/oauth/token"
tags: ["OAuth & SSO"]
---

# OAuth Token Exchange

`POST /api/oauth/token`

## Request

- Base URL: `https://flowdot.ai/api`
- URL: `https://flowdot.ai/api/api/oauth/token`
- Auth: none declared

Exchange authorization code for access token.

## Request body

- object
  - `code` string: Authorization code (for authorization_code grant)
  - `client_id` string: OAuth client ID
  - `grant_type` 'authorization_code' | 'refresh_token'
  - `redirect_uri` string: Must match original redirect URI
  - `client_secret` string: OAuth client secret
  - `code_verifier` string: PKCE code verifier
  - `refresh_token` string: Refresh token (for refresh_token grant)

## Response `200`

Successful response

- unknown

## Other responses

- `400`: Invalid grant or client credentials
- `401`: Invalid client authentication

---

[API](https://skmtc.dev/flowdot/apis/flowdot-api.md) · [All operations](https://skmtc.dev/flowdot/apis/flowdot-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flowdot/apis/flowdot-api/revisions/93f63cc9c775?raw)