> ## Documentation Index
> Fetch the complete documentation index at: https://developer.eka.care/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange Tokens

> Exchanges a single-use authorization code for tokens, or exchanges a
refresh token for a new token set.

Send parameters as `application/x-www-form-urlencoded`, including
`client_id` and `client_secret` in the form body.


Use this endpoint from your backend to:

* Exchange an authorization code using `grant_type=authorization_code`.
* Refresh a token set using `grant_type=refresh_token`.

Authorization codes are short-lived and can be used only once. If the authorization request used PKCE,
send the original `code_verifier` during the code exchange. A verifier is not used for the refresh-token grant.


## OpenAPI

````yaml post /oauth2/token
openapi: 3.0.3
info:
  title: Eka OIDC Provider
  version: 1.0.0
  description: OAuth 2.0 and OpenID Connect endpoints for signing users in with Eka.
servers:
  - description: Production
    url: https://accounts.eka.care
  - description: Stage/Sandbox
    url: https://aortago.dev.eka.care
security: []
tags:
  - name: Eka OIDC Provider
paths:
  /oauth2/token:
    post:
      tags:
        - Eka OIDC Provider
      summary: Exchange or refresh tokens
      description: |
        Exchanges a single-use authorization code for tokens, or exchanges a
        refresh token for a new token set.

        Send parameters as `application/x-www-form-urlencoded`, including
        `client_id` and `client_secret` in the form body.
      operationId: exchangeToken
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              oneOf:
                - $ref: '#/components/schemas/AuthorizationCodeTokenRequest'
                - $ref: '#/components/schemas/RefreshTokenRequest'
            examples:
              authorization_code:
                summary: Exchange an authorization code
                value:
                  grant_type: authorization_code
                  code: ory_ac_example
                  redirect_uri: http://localhost:50515/auth-success
                  client_id: EC_178843954824934
                  client_secret: your_client_secret
                  code_verifier: your_original_pkce_code_verifier
              refresh_token:
                summary: Refresh tokens
                value:
                  grant_type: refresh_token
                  refresh_token: ory_rt_example
                  client_id: EC_178843954824934
                  client_secret: your_client_secret
      responses:
        '200':
          description: Token response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
              example:
                access_token: ory_at_example
                token_type: bearer
                expires_in: 3600
                scope: openid profile email offline_access
                refresh_token: ory_rt_example
                id_token: eyJhbGciOiJSUzI1NiIsImtpZCI6ImVrYS1lbXIifQ.example
        '400':
          description: |
            Invalid request or grant. Common causes include an expired or reused
            authorization code, a mismatched `redirect_uri`, an invalid PKCE
            verifier, or an expired or reused refresh token.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '401':
          description: Client authentication failed.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
components:
  schemas:
    AuthorizationCodeTokenRequest:
      type: object
      required:
        - grant_type
        - code
        - redirect_uri
        - client_id
        - client_secret
      properties:
        grant_type:
          type: string
          enum:
            - authorization_code
        code:
          type: string
          description: Short-lived, single-use code returned by `/oauth2/authorize`.
        redirect_uri:
          type: string
          format: uri
          description: Must exactly match the URI used in the authorization request.
        client_id:
          type: string
          description: Client identifier issued by Eka.
        client_secret:
          type: string
          format: password
          description: Client secret issued by Eka.
        code_verifier:
          type: string
          minLength: 43
          maxLength: 128
          description: >-
            Original PKCE verifier. Required when the authorization request used
            PKCE.
    RefreshTokenRequest:
      type: object
      required:
        - grant_type
        - refresh_token
        - client_id
        - client_secret
      properties:
        grant_type:
          type: string
          enum:
            - refresh_token
        refresh_token:
          type: string
          description: Refresh token previously issued by this endpoint.
        client_id:
          type: string
          description: Must identify the client to which the refresh token was issued.
        client_secret:
          type: string
          format: password
          description: Client secret issued by Eka.
    TokenResponse:
      type: object
      required:
        - access_token
        - token_type
        - expires_in
      properties:
        access_token:
          type: string
          description: Bearer token used to authorize Eka API requests.
        token_type:
          type: string
          example: bearer
        expires_in:
          type: integer
          format: int64
          description: Access-token lifetime in seconds.
        scope:
          type: string
          description: Space-separated scopes granted to the token.
        refresh_token:
          type: string
          description: Token used to obtain a new token set.
        id_token:
          type: string
          description: OpenID Connect ID token returned when `openid` was granted.
    OAuthError:
      type: object
      required:
        - error
      properties:
        error:
          type: string
          example: invalid_grant
        error_description:
          type: string
          example: >-
            The provided authorization grant is invalid, expired, or already
            used.

````