---
title: "Exchange an authorization code"
method: POST
path: "/auth/oauth/token"
tags: ["auth", "oauth"]
---

# Exchange an authorization code

`POST /auth/oauth/token`

## Request

- Base URL: `https://api.namefi.io/v-next`
- URL: `https://api.namefi.io/v-next/auth/oauth/token`
- Auth: one of:
  - API key in header `x-api-key`
  - HTTP bearer

Exchange an authorization code (from the redirect) plus the PKCE code verifier for the account JWT. Single-use; verifies the code is bound to the same client_id and redirect_uri.

## Headers

- `x-namefi-eip7702-account` string
- `x-namefi-eip1271-account` string
- `x-namefi-erc1271-account` string

## Request body

- object: Exchange an authorization code (+ PKCE verifier) for the account JWT.
  - `code` string, required: Authorization code received on the redirect_uri.
  - `codeVerifier` string, required: PKCE code verifier matching the codeChallenge from authorize.
  - `clientId` string, required: The client_id the authorization code was issued for.
  - `redirectUri` string, uri, required: The redirect_uri the authorization code was issued for.
  - `resource` string, uri: Optional RFC 8707 resource indicator. When provided it must match the resource the authorization code was issued for; the minted JWT is already bound to that resource.

## Response `200`

OK

- object: The minted account JWT and minimal user details.
  - `token` string, required: JWT to send as an Authorization: Bearer credential.
  - `tokenType` 'Bearer', required
  - `expiresAt` string, date-time, required: ISO timestamp after which the token expires.
  - `user` object, required: Minimal user details delivered alongside an approved token.
    - `id` string, uuid, required: Authenticated user id.
    - `primaryEmail` string, nullable: Primary email of the authenticated user, if any.
    - `walletAddress` string, nullable: A linked wallet address of the authenticated user, if any.

## Other responses

- `400`: 400
- `401`: 401
- `402`: 402
- `403`: 403
- `404`: 404
- `406`: 406
- `408`: 408
- `409`: 409
- `412`: 412
- `429`: 429
- `500`: 500

---

[API](https://skmtc.dev/namefi/apis/namefi-api.md) · [All operations](https://skmtc.dev/namefi/apis/namefi-api/llms.txt) · [OpenAPI document](https://skmtc.dev/namefi/apis/namefi-api/revisions/3c7c3ade95c9?raw)