Exchange Tokens - Eka Developer Platform APIs

Authorization

End-to-End Encryption

Connect

HealthAI

Medical Database

ABDM Connect

Doctor Tool

Medical Knowledge-bases

Medical Records

User App

curl --request POST \
  --url https://accounts.eka.care/oauth2/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=authorization_code \
  --data code=ory_ac_example \
  --data redirect_uri=http://localhost:50515/auth-success \
  --data client_id=EC_178843954824934 \
  --data client_secret=your_client_secret \
  --data code_verifier=your_original_pkce_code_verifier

{
  "access_token": "ory_at_example",
  "token_type": "bearer",
  "expires_in": 3600,
  "scope": "openid profile email offline_access",
  "refresh_token": "ory_rt_example",
  "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImVrYS1lbXIifQ.example"
}

{
  "error": "invalid_grant",
  "error_description": "The provided authorization grant is invalid, expired, or already used."
}

{
  "error": "invalid_grant",
  "error_description": "The provided authorization grant is invalid, expired, or already used."
}

POST

oauth2

token

curl --request POST \
  --url https://accounts.eka.care/oauth2/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=authorization_code \
  --data code=ory_ac_example \
  --data redirect_uri=http://localhost:50515/auth-success \
  --data client_id=EC_178843954824934 \
  --data client_secret=your_client_secret \
  --data code_verifier=your_original_pkce_code_verifier

{
  "access_token": "ory_at_example",
  "token_type": "bearer",
  "expires_in": 3600,
  "scope": "openid profile email offline_access",
  "refresh_token": "ory_rt_example",
  "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6ImVrYS1lbXIifQ.example"
}

{
  "error": "invalid_grant",
  "error_description": "The provided authorization grant is invalid, expired, or already used."
}

{
  "error": "invalid_grant",
  "error_description": "The provided authorization grant is invalid, expired, or already used."
}

Use this endpoint from your backend to:

Exchange an authorization code using grant_type=authorization_code.
Refresh a token set using grant_type=refresh_token.

Authorization codes are short-lived and can be used only once. If the authorization request used PKCE, send the original code_verifier during the code exchange. A verifier is not used for the refresh-token grant.

Body

application/x-www-form-urlencoded

Option 1
Option 2

grant_type

enum<string>

required

Available options:

authorization_code

code

string

required

Short-lived, single-use code returned by /oauth2/authorize.

redirect_uri

string<uri>

required

Must exactly match the URI used in the authorization request.

client_id

string

required

Client identifier issued by Eka.

client_secret

string<password>

required

Client secret issued by Eka.

code_verifier

string

Original PKCE verifier. Required when the authorization request used PKCE.

Required string length: 43 - 128

Response

Token response.

access_token

string

required

Bearer token used to authorize Eka API requests.

token_type

string

required

Example:

"bearer"

expires_in

integer<int64>

required

Access-token lifetime in seconds.

scope

string

Space-separated scopes granted to the token.

refresh_token

string

Token used to obtain a new token set.

id_token

string

OpenID Connect ID token returned when openid was granted.