2. Exchange Code for Access Token

Endpoint:

POST <https://$>{AUTH_DOMAIN}/oauth2/token
Content-Type: application/x-www-form-urlencoded

Parameters:

Parameter	Type	Description
client_id	string	Your DAR ID client ID
client_secret	string	Your DAR ID client secret
code	string	The code received from step 1
grant_type	string	Must be "authorization_code"
redirect_uri	string	Must match the URI from step 1
code_verifier	string	Required if PKCE was used in step 1

Example Request:

curl -X POST ${AUTH_DOMAIN}/oauth2/token \\\\
  -H "Content-Type: application/x-www-form-urlencoded" \\\\
  -d "client_id=${CLIENT-ID}&client_secret=${CLIENT-SECRET}&code=${CODE}&grant_type=authorization_code&redirect_uri=${REDIRECT-URI}"

Response:

{
  "access_token": "${access_token}",
  "expires_in": 86400,
  "refresh_token": "${refresh_token}",
  "scope": "Read",
  "token_type": "Bearer"
}