Code Exchange
There are two ways to exchange a code for an access / refresh token pair:
- Using a Basic Auth header to send the
client_idandclient_secret - Use the
client_idandclient_secretas part of the x-www-form-urlencoded body
Tip
Use the Basic Auth header to prevent passing confidential information as part of a query string that could be logged. For example a web server hosting an Nginx load balancer could log the request with the full query string.
You can exchange the received code for token by sending a POST request to the following URL:
Upon a successful exchange, you will receive a pair of tokens with their expiration times. The expiration time for access tokens is 1 hour and 1 year for refresh tokens from the time of grant.