Exchange a native authorization code or refresh token
Exchange a native authorization code or refresh token
POST/api/v1/mobile/oauth/token
Exchanges a native authorization code with its PKCE verifier, or the
current rotating refresh token, for the next 15-minute opaque access
token and refresh token. The request is bound to the registered public
client and installation. Responses always carry Cache-Control: no-store; raw credentials must never be logged, cached, or placed in
a URL. Reuse of an already-consumed refresh token revokes its entire
credential family and requires browser reauthentication.
Request Body
application/json
Responses
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
access_tokenRequired
string <password>·min 43·max 128
refresh_tokenRequired
string <password>·min 43·max 128
token_typeRequired
string·const Bearer
expires_inRequired
integer·min 0·max 900
Native access-token lifetime in seconds, capped by the credential family absolute expiry. Zero means reauthentication is required.
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
X-Request-ID
string·min 1·max 200
Correlation identifier for the request.
X-Content-Type-Options
string·const nosniff
Prevents user agents from MIME-sniffing the response.
errorRequired
object
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
X-Request-ID
string·min 1·max 200
Correlation identifier for the request.
X-Content-Type-Options
string·const nosniff
Prevents user agents from MIME-sniffing the response.
errorRequired
object
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
X-Request-ID
string·min 1·max 200
Correlation identifier for the request.
X-Content-Type-Options
string·const nosniff
Prevents user agents from MIME-sniffing the response.
errorRequired
object
Retry-After
integer·min 0
Delay in seconds before retrying, when an expected maintenance end is known.
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
X-Request-ID
string·min 1·max 200
Correlation identifier for the request.
X-Content-Type-Options
string·const nosniff
Prevents user agents from MIME-sniffing the response.
