> ## Documentation Index > Fetch the complete documentation index at: https://docs.mapp.com/llms.txt > Use this file to discover all available pages before exploring further. # exchange a grant code or refresh token for a JWT > This allows the client to exchange a previously obtained grant code or refresh token for an access token for immediate use and a refresh token for subsequent requests. It may return an updated refresh token, in which case the stored refresh token should be updated The redirect URI must be set to urn:ietf:wg:oauth:2.0:oob:auto When exchanging a grant code from the authorize endpoint: - set grant_type to authorization_code - set code to the code returned by the authorize endpoint When refreshing a token: - set grant_type to refresh_token - set refresh_token to the previously obtained refresh token ## OpenAPI ````json POST /oauth/token { "openapi": "3.0.4", "info": { "title": "Mapp Fashion API", "description": "Mapp Fashion recommendation API.\n\n**Host:** there is no shared API host. A dedicated host is configured per partner and supplied during onboarding. All paths below are relative to that host.\n\nTwo versions are available in parallel. **v1** (`/api/...`) covers the established endpoints and is fully maintained, with no deprecation planned. **v2** (`/api/v2/...`) standardizes the inputs and provides one endpoint per recommendation type. New integrations should use v2 wherever a v2 endpoint exists. See Recommendation Strategy for which endpoint to use when.\n", "version": "13" }, "servers": [ { "url": "/api" } ], "security": [ { "api_key": [] }, { "api_key": [], "user_token": [] } ], "tags": [ { "name": "Items", "description": "Operations for retrieving recommendations or items related to one or more seed items" }, { "name": "Items (v2)", "description": "v2: one endpoint per recommendation type, identifiers passed as parameters" }, { "name": "Recommendations", "description": "Operations about recommendations" }, { "name": "Recommendations (v2)", "description": "v2: facetted recommendations in the v2 response format" }, { "name": "Authorization", "description": "Operations for obtaining or refreshing JWTs" } ], "paths": { "/oauth/token": { "post": { "tags": [ "Authorization" ], "summary": "exchange a grant code or refresh token for a JWT", "description": "This allows the client to exchange a previously obtained grant code or refresh token for an access token for immediate use and a refresh token for subsequent requests.\n\nIt may return an updated refresh token, in which case the stored refresh token should be updated\n\nThe redirect URI must be set to urn:ietf:wg:oauth:2.0:oob:auto\n\nWhen exchanging a grant code from the authorize endpoint:\n- set grant_type to authorization_code\n- set code to the code returned by the authorize endpoint\n\nWhen refreshing a token:\n- set grant_type to refresh_token\n- set refresh_token to the previously obtained refresh token\n\n", "operationId": "postOauthToken", "requestBody": { "content": { "application/x-www-form-urlencoded": { "schema": { "required": [ "redirect_uri", "grant_type", "client_id" ], "type": "object", "properties": { "redirect_uri": { "enum": [ "urn:ietf:wg:oauth:2.0:oob:auto" ], "type": "string" }, "grant_type": { "enum": [ "authorization_code", "refresh_token" ], "type": "string" }, "code": { "type": "string", "description": "the authorization_code previously obtained" }, "refresh_token": { "type": "string", "description": "the refresh_token previously obtained" }, "client_id": { "type": "string", "description": "the api client id supplied by Mapp Fashion" }, "code_verifier": { "type": "string", "description": "for authorization_code requests, the code_verifier that was used to generate the associated code_challenge" } } } } } }, "responses": { "200": { "description": "The generated tokens", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TokenResponse" } } } }, "400": { "description": "oauth2 error", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } } } }, "security": [] } } }, "components": { "schemas": { "TokenResponse": { "type": "object", "properties": { "access_token": { "type": "string", "description": "The access token for the user", "example": "eyJhbGciOiJIUzI1NiJ9.eyJleHAiOjE1NzE5OTQ2NzIsImlhdCI6MTU3MTkwODI3Miwic3ViIjoiOTQxNzMifQ.mb3ur-cCDbApKU1j24SkjgR7AjLNGQ2pHkJdpfKtY28" }, "refresh_token": { "type": "string", "description": "The refresh token for the user", "example": "WzEsWzk0MTczXSwiaGF5ZFJDalRqX1R6RlhzQnlrnXoiLCIxNTcx1TA4MjcyLjM4NDM0NCJd--df2b0e0d9fc63bf536ba2bb807ec7b0d127145ba" }, "expires_in": { "type": "integer", "description": "The lifetime of the token, in seconds", "format": "int32", "example": 86400 }, "token_type": { "type": "string", "description": "The access_token type (this will always be Bearer)", "example": "Bearer" } }, "description": "This allows the client to exchange a previously obtained grant code or refresh token for an access token for immediate use and a refresh token for subsequent requests.\n\nIt may return an updated refresh token, in which case the stored refresh token should be updated\n\nThe redirect URI must be set to urn:ietf:wg:oauth:2.0:oob:auto\n\nWhen exchanging a grant code from the authorize endpoint:\n- set grant_type to authorization_code\n- set code to the code returned by the authorize endpoint\n\nWhen refreshing a token:\n- set grant_type to refresh_token\n- set refresh_token to the previously obtained refresh token\n" }, "ErrorResponse": { "type": "object", "properties": { "error": { "type": "string", "description": "The error code (one of the error codes defined by https://tools.ietf.org/html/rfc6749#section-4.1", "example": "invalid_request" }, "error_description": { "type": "string", "description": "A human readable description of the error" } }, "description": "Generic oauth error object" } } } } ````