curl --request POST \
--url https://accounts.eka.care/oauth2/token \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data grant_type=authorization_code \
--data code=ory_ac_example \
--data redirect_uri=http://localhost:50515/auth-success \
--data client_id=EC_178843954824934 \
--data client_secret=your_client_secret \
--data code_verifier=your_original_pkce_code_verifier{
"access_token": "ory_at_example",
"token_type": "bearer",
"expires_in": 3600,
"scope": "openid profile email offline_access",
"refresh_token": "ory_rt_example",
"id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImVrYS1lbXIifQ.example"
}{
"error": "invalid_grant",
"error_description": "The provided authorization grant is invalid, expired, or already used."
}{
"error": "invalid_grant",
"error_description": "The provided authorization grant is invalid, expired, or already used."
}Exchange Tokens
Exchanges a single-use authorization code for tokens, or exchanges a refresh token for a new token set.
Refresh tokens are rotated on every refresh: each successful
refresh_token grant returns a new refresh_token and invalidates the
one that was sent. Always persist the latest refresh token from the
response.
Send parameters as application/x-www-form-urlencoded, including
client_id and client_secret in the form body.
curl --request POST \
--url https://accounts.eka.care/oauth2/token \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data grant_type=authorization_code \
--data code=ory_ac_example \
--data redirect_uri=http://localhost:50515/auth-success \
--data client_id=EC_178843954824934 \
--data client_secret=your_client_secret \
--data code_verifier=your_original_pkce_code_verifier{
"access_token": "ory_at_example",
"token_type": "bearer",
"expires_in": 3600,
"scope": "openid profile email offline_access",
"refresh_token": "ory_rt_example",
"id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImVrYS1lbXIifQ.example"
}{
"error": "invalid_grant",
"error_description": "The provided authorization grant is invalid, expired, or already used."
}{
"error": "invalid_grant",
"error_description": "The provided authorization grant is invalid, expired, or already used."
}- Exchange an authorization code using
grant_type=authorization_code. - Refresh a token set using
grant_type=refresh_token.
code_verifier during the code exchange. A verifier is not used for the refresh-token grant.
Refresh tokens are rotated on every refresh. Each successful refresh_token grant returns a new
refresh_token and invalidates the one you sent, so always store the latest refresh token from the
response and use it for the next refresh. Reusing an old refresh token returns an invalid_grant error.Body
- Option 1
- Option 2
authorization_code Short-lived, single-use code returned by /oauth2/authorize.
Must exactly match the URI used in the authorization request.
Client identifier issued by Eka.
Client secret issued by Eka.
Original PKCE verifier. Required when the authorization request used PKCE.
43 - 128Response
Token response.
Bearer token used to authorize Eka API requests.
"bearer"
Access-token lifetime in seconds.
Space-separated scopes granted to the token.
Token used to obtain a new token set. A new refresh token is issued on every refresh and the previous one is invalidated, so replace the stored value with this one after each call.
OpenID Connect ID token returned when openid was granted.
Was this page helpful?