Exchange Token

Exchange an authorization code or refresh token for access tokens.

No authentication required. This is a public endpoint (client authenticates via client_id/client_secret).

Request example

123456789curl -X POST https://api.v2.dealmachine.com/v1/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "client_id": "dm_cid_abc123",
    "client_secret": "dm_cs_xxx",
    "code": "dm_ac_xxx",
    "redirect_uri": "http://localhost:3000/callback"
  }'

Response example

1234567{
  "access_token": "dm_at_live_xxx",
  "refresh_token": "dm_rt_xxx",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "account:read"
}

Grant Types

`authorization_code`

Exchange an authorization code (from the /oauth/authorize flow) for tokens.

Field	Type	Required	Description
`grant_type`	string	Yes	`authorization_code`
`client_id`	string	Yes	Your application's client ID
`client_secret`	string	Yes*	Your application's client secret
`code`	string	Yes	The authorization code
`redirect_uri`	string	Yes	Must match the original authorize request
`code_verifier`	string	No**	PKCE code verifier

* Not required for public clients using PKCE. ** Required if code_challenge was used in the authorize request.

`refresh_token`

Exchange a refresh token for a new token pair.

Field	Type	Required	Description
`grant_type`	string	Yes	`refresh_token`
`client_id`	string	Yes	Your application's client ID
`client_secret`	string	Yes*	Your application's client secret
`refresh_token`	string	Yes	The refresh token

Token Lifetimes

Token	Lifetime
Access Token	1 hour
Refresh Token	30 days

Refresh tokens are rotated on use. When you exchange a refresh token, the old tokens are revoked and new ones are issued. Always store the new refresh token from the response.