---
title: "Exchange Oauth Token Endpoint"
method: POST
path: "/auth/oauth/exchange"
tags: ["auth"]
---

# Exchange Oauth Token Endpoint

`POST /auth/oauth/exchange`

Exchange a Stytch OAuth token for a session token and JWT.

Called by the browser app after Stytch redirects back with ?token=xxx.
Intentionally unauthenticated — this endpoint IS the authentication mechanism.
The Stytch secret key never leaves the server.

## Request body

- OAuthExchangeRequest
  - `token` string, required

## Response `200`

Successful Response

- OAuthExchangeResponse
  - `session_token` string, required
  - `session_jwt` string, required
  - `user_id` string, nullable, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/tryscott/apis/one-shot-api.md) · [All operations](https://skmtc.dev/tryscott/apis/one-shot-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/tryscott/one-shot-api/revisions/28bdface01df/schema)