Exchange a code or rotate a refresh token

Public clients send client_id in form; Authorization headers are rejected. Authorization code binds client_id, exact redirect_uri and S256 verifier (43–128 unreserved ASCII characters), expires in 60 seconds, and is single-use. Refresh tokens require offline_access, rotate on every use, and retain the fixed 30-day grant deadline. Reusing a successfully exchanged code or used refresh token revokes the entire grant, including outstanding access/refresh tokens; no retry grace. Wrong client, redirect or verifier cannot exchange the code. Optional refresh scope permanently narrows the grant; it cannot widen. Current user permissions and client enabled status apply. Organization/service/PAT secrets are never issued. No implicit, password or client_credentials grant.

Response headers:

Cache-Control (200).
Referrer-Policy (200).
Pragma (200).

Request

This endpoint expects an object.

objectRequired

Response headers

Cache-Control"no-store"Optional

Referrer-Policy"no-referrer"Optional

Pragma"no-cache"Optional

Response

New opaque access token and optional rotating refresh token.

access_tokenstringformat: "^oa_[a-f0-9]{64}$"

token_type"Bearer"

expires_ininteger0-900

scopestring1-512 characters

refresh_tokenstringOptionalformat: "^or_[a-f0-9]{64}$"