OAuth 2.1

Exchange a code or refresh token

Returns an access token valid for 3,600 seconds. Public clients must use PKCE.

Authentication

Authorizationnot required

This endpoint is public and takes no access token.

Body parameters

application/x-www-form-urlencoded

grant_typeauthorization_code | refresh_tokenrequired

The OAuth grant being exchanged.

client_idstringrequired

The OAuth client identifier.

codestring

Authorization code. Required for the authorization_code grant.

redirect_uriURL

Must exactly match the URI used during authorization.

code_verifierstring

PKCE verifier corresponding to the authorization request.

refresh_tokenstring

Refresh token. Required for the refresh_token grant.

Responses

200Successful response

400The request is invalid

429Rate limit exceeded

const response = await fetch('https://api.ufw.dev/oauth2/v2.0/token', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/x-www-form-urlencoded',
  },
  body: new URLSearchParams({
    "grant_type": "authorization_code",
    "client_id": "YOUR_CLIENT_ID",
    "code": "AUTHORIZATION_CODE",
    "redirect_uri": "https://example.com/oauth/callback",
    "code_verifier": "YOUR_CODE_VERIFIER"
  }),
});

const data = await response.json();

Response200

{
  "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjIwMjYtMDUtcnNhIn0…",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "openid profile podcasts.read",
  "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjIwMjYtMDUtcnNhIn0…"
}