# Exchange a code or refresh token
`GET https://tokens.livepush.io/oauth2/access_token`
Exchanges an authorization code for an access and refresh token pair, or rotates an existing refresh token. Access tokens are valid for 14 days.

Refresh tokens are single use — the supplied one is disabled as soon as a new pair is issued, so store the new `refresh_token` from every response.

**Call this server-side only.** It is a `GET` and takes `client_secret` as a query parameter, so the secret lands in proxy logs, browser history and access logs if it is ever called from a client. Make sure your own logging redacts it.
- **Tag:** Authentication
- **Operation ID:** `getOAuth2Token`
- **Authentication:** None
- **Docs:** https://developers.livepush.io/authentication/exchange-a-code-or-refresh-token/

### Query parameters

| Name | Type | Required | Description |
| --- | --- | --- | --- |
| `grant_type` | string | yes | Use authorizationcode for a fresh grant, or refreshtoken to rotate an existing one. |
| `code` | string | yes | The grant code, or — when granttype is refreshtoken — the refresh token. Both are passed in this same parameter. |
| `client_id` | string | yes | Client ID issued by the developer console. |
| `client_secret` | string | yes | Client secret. Server-side only. |
| `redirect_uri` | string | yes | Must match the value the code was issued against. |


### Example request

```bash
curl -X GET 'https://tokens.livepush.io/oauth2/access_token?grant_type=authorization_code&code=%3Ccode%3E&client_id=%3Cclient_id%3E&client_secret=%3Cclient_secret%3E&redirect_uri=https%3A%2F%2Fyourapp.example.com%2Fcallback'
```


### Responses


#### 200 — A new token pair.

- `access_token` (string) — JWT to send as Authorization: Bearer <accesstoken.
- `refresh_token` (string) — Opaque token for obtaining the next pair.
- `token_type` (string) — Always the literal accesstoken. Non-standard — send the header as Authorization: Bearer … regardless of this value.
- `expires_in` (integer) — Access token lifetime in seconds. 14 days.


```json
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…",
  "refresh_token": "V1StGXR8_Z5jdHi6B-myT…",
  "token_type": "access_token",
  "expires_in": 1209600
}
```


#### 400 — The exchange failed.

- `error` (string)
- `error_description` (string)


```json
{
  "error": "invalid_client",
  "error_description": "could not identify provided \"client_id\""
}
```