---
title: "Oauth Exchange"
method: POST
path: "/api/auth/oauth/exchange"
tags: ["auth"]
---

# Oauth Exchange

`POST /api/auth/oauth/exchange`

## Request

- Base URL: `https://fojin.app` (the document declares no server; this is the origin it was published from)
- URL: `https://fojin.app/api/auth/oauth/exchange`
- Auth: none declared

Exchange a short-lived OAuth code for a JWT.

The OAuth provider callback redirects the browser to the frontend with
only an opaque code in the URL. The frontend POSTs that code here to
obtain the actual JWT — keeping the JWT out of nginx access logs,
browser history, and Referer headers.

The code is consumed atomically (GETDEL) and is single-use.

## Request body

- OAuthExchangeRequest
  - `code` string, required

## Response `200`

Successful Response

- TokenResponse
  - `access_token` string, required
  - `token_type` string

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/fojin/apis/fojin-api-buddhist-digital-text-platform.md) · [All operations](https://skmtc.dev/fojin/apis/fojin-api-buddhist-digital-text-platform/llms.txt) · [OpenAPI document](https://skmtc.dev/fojin/apis/fojin-api-buddhist-digital-text-platform/revisions/969714238c61?raw)