Token Exchange
Turn the authorization code into an access_token with PKCE. Paste script and Web SDK do this for you; call it yourself for server-driven flows.
On this page
When exchange runs
Server-driven integrations call exchange on the backend after the browser returns code + state (with the stored code_verifier).
REST
POST
/oauth/tokenPOST https://auth.keyra.ie/oauth/token
Content-Type: application/json
{
"grant_type": "authorization_code",
"code": "…",
"code_verifier": "…",
"redirect_uri": "https://example.com/auth/keyra/callback",
"client_id": "cp_test_…"
}| Field | Required | Description |
|---|---|---|
grant_type | Yes | authorization_code |
code | Yes | Authorization code from hosted UI |
code_verifier | Yes | PKCE verifier matching the start challenge |
redirect_uri | Yes | Same URI used at start (exact match) |
client_id | Yes | Publishable client id |
Server SDK
import { createKeyraServer } from "@keyra/typescript-sdk";
const keyra = createKeyraServer({ baseUrl: "https://auth.keyra.ie" });
const token = await keyra.exchangeAuthorizationCode({
code,
code_verifier: codeVerifier,
redirect_uri: redirectUri,
client_id: clientId,
});
// token.access_token — alias as verification_token for validateResponse
responsePOST /oauth/token (success)
{
"access_token": "…",
"token_type": "Bearer",
"expires_in": 3600,
"user": {
"id": 123,
"phone": "+353…",
"fullName": null,
"email": null
}
}Paste script and Web SDK expose the same value as verification_token / verificationToken for DX. Optional userinfo: User info.