---
title: "Authorization Code Exchange"
method: POST
path: "/rest/v2/auth/auth-code-redemption.json"
tags: ["OAuth2 Flow"]
---

# Authorization Code Exchange

`POST /rest/v2/auth/auth-code-redemption.json`

## Request

- Base URL: `https://api.runsignup.com`
- URL: `https://api.runsignup.com/rest/v2/auth/auth-code-redemption.json`
- Auth: none declared
- TypeScript: <https://skmtc.dev/runsignup/apis/runsignup-oauth2-authentication-api/docs/rest/v2/auth/auth-code-redemption.json/post.ts> (a function with typed inputs; its response is checked against the schema)

Exchange authorization code for access token and refresh token.

## Request body `application/x-www-form-urlencoded`

- object
  - `grant_type` 'authorization_code', required: OAuth2 grant type. Must be 'authorization_code'.
  - `client_id` string, required: OAuth2 client identifier.
  - `client_secret` string, required: OAuth2 client secret (base64 encoded).
  - `code` string, required: Authorization code received from authorization endpoint.
  - `redirect_uri` string, uri, required: Redirect URI used in authorization request.
  - `code_verifier` string: PKCE code verifier (required if code_challenge was used).

## Response `200`

Successful token exchange

- TokenResponse
  - `access_token` string, required: OAuth2 access token (JWT format)
  - `token_type` 'Bearer', required: Token type for authorization header
  - `expires_in` integer, required: Access token lifetime in seconds
  - `refresh_token` string: Refresh token for obtaining new access tokens
  - `scope` string: Granted access scope

## Other responses

- `400`: Bad Request - Invalid authorization code or client credentials
- `401`: Unauthorized - Invalid client credentials

---

[API](https://skmtc.dev/runsignup/apis/runsignup-oauth2-authentication-api.md) - [All operations](https://skmtc.dev/runsignup/apis/runsignup-oauth2-authentication-api/llms.txt) - [OpenAPI document](https://skmtc.dev/runsignup/apis/runsignup-oauth2-authentication-api/revisions/6195b3437b58?raw)