Exchange an authorization code for tokens
curl --request POST \
--url https://web-api.soxai.site/oauth2/token \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data grant_type=authorization_code \
--data 'code=<authorization-code>' \
--data client_id=client_123 \
--data 'client_secret=<client-secret>' \
--data nonce=nonce_123import requests
url = "https://web-api.soxai.site/oauth2/token"
payload = {
"grant_type": "authorization_code",
"code": "<authorization-code>",
"client_id": "client_123",
"client_secret": "<client-secret>",
"nonce": "nonce_123"
}
headers = {"Content-Type": "application/x-www-form-urlencoded"}
response = requests.post(url, data=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/x-www-form-urlencoded'},
body: new URLSearchParams({
grant_type: 'authorization_code',
code: '<authorization-code>',
client_id: 'client_123',
client_secret: '<client-secret>',
nonce: 'nonce_123'
})
};
fetch('https://web-api.soxai.site/oauth2/token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"id_token": "<idToken>",
"refresh_token": "<refreshToken>"
}{
"error": "bad-request",
"error_msg": "Invalid nonce."
}{
"error": "forbidden",
"error_msg": "Invalid client credentials."
}{
"error": "not-found",
"error_msg": "Access code not found."
}{
"error": "query-time-out",
"error_msg": "Access code expired."
}{
"error": "unprocessable-entity",
"error_msg": "body.<field>: <validation message>"
}{
"error": "rate-limited",
"error_msg": "Rate limit exceeded. Retry after <n> seconds."
}{
"error": "internal-server-error",
"error_msg": "Failed to fetch data: <error_message>"
}{
"error": "service-unavailable",
"error_msg": "Service unavailable."
}OAuth2
Exchange an authorization code for tokens
Exchange the authorization code from the consent redirect for the end
user’s tokens. This is the OAuth2 token endpoint, called by the client’s backend rather than
by a browser.
Parameters
- Form fields:
grant_type(must beauthorization_code),code,client_idandclient_secretare required.nonceis required when the authorization request carried one, and must be the same value.
Response
200returnsid_tokenandrefresh_token. Sendid_tokenasAuthorization: Bearer <idToken>; it expires in about an hour andrefresh_tokenrenews it atPOST /api/refreshToken. The authorizationcodeis consumed and cannot be exchanged again. Codes can only be exchanged by the client they were issued to, and the client’s registered redirect URI must still match the issuance record.
Errors
| Status | Condition |
|---|---|
| 400 | grant_type is not authorization_code, or nonce does not match the one issued with the code |
| 403 | client_id and client_secret do not identify a registered client |
| 404 | The authorization code is unknown or has already been consumed |
| 408 | The authorization code is older than five minutes. Start the flow again |
| 503 | The identity provider could not issue the tokens. Retry later |
Authorization
- No SOXAI user token. The client authenticates with its own
client_idandclient_secret.
POST
/
oauth2
/
token
Exchange an authorization code for tokens
curl --request POST \
--url https://web-api.soxai.site/oauth2/token \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data grant_type=authorization_code \
--data 'code=<authorization-code>' \
--data client_id=client_123 \
--data 'client_secret=<client-secret>' \
--data nonce=nonce_123import requests
url = "https://web-api.soxai.site/oauth2/token"
payload = {
"grant_type": "authorization_code",
"code": "<authorization-code>",
"client_id": "client_123",
"client_secret": "<client-secret>",
"nonce": "nonce_123"
}
headers = {"Content-Type": "application/x-www-form-urlencoded"}
response = requests.post(url, data=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/x-www-form-urlencoded'},
body: new URLSearchParams({
grant_type: 'authorization_code',
code: '<authorization-code>',
client_id: 'client_123',
client_secret: '<client-secret>',
nonce: 'nonce_123'
})
};
fetch('https://web-api.soxai.site/oauth2/token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"id_token": "<idToken>",
"refresh_token": "<refreshToken>"
}{
"error": "bad-request",
"error_msg": "Invalid nonce."
}{
"error": "forbidden",
"error_msg": "Invalid client credentials."
}{
"error": "not-found",
"error_msg": "Access code not found."
}{
"error": "query-time-out",
"error_msg": "Access code expired."
}{
"error": "unprocessable-entity",
"error_msg": "body.<field>: <validation message>"
}{
"error": "rate-limited",
"error_msg": "Rate limit exceeded. Retry after <n> seconds."
}{
"error": "internal-server-error",
"error_msg": "Failed to fetch data: <error_message>"
}{
"error": "service-unavailable",
"error_msg": "Service unavailable."
}Body
application/x-www-form-urlencoded
Response
The tokens for the authorization code, which is consumed and cannot be exchanged again. id_token is the credential the SOXAI API accepts as Authorization: Bearer, and refresh_token renews it.