> ## Documentation Index
> Fetch the complete documentation index at: https://humanity-eaeda8f6.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth · Token & revoke

<Callout>
  **SDK equivalent**

  ```ts theme={null}
  const tokens = await sdk.exchangeCodeForToken(code, codeVerifier);
  ```
</Callout>

Exchange an authorization code for tokens or refresh existing sessions. Populate the body with either:

* `grant_type=authorization_code`, `code`, `redirect_uri`, `code_verifier`
* `grant_type=refresh_token`, `refresh_token`

Tokens inherit the scopes approved in the `/oauth/authorize` step. Use the companion [`POST /oauth/revoke`](/api-reference/introduction) operation to invalidate a refresh or access token when a user withdraws consent.


## OpenAPI

````yaml api-reference/openapi.json post /oauth/token
openapi: 3.1.0
info:
  version: 0.1.0
  title: hp-public-dev-api-server
  description: NestJS CQRS + TDD base for Humanity Public Dev API
servers:
  - url: https://api.sandbox.humanity.org/v2
    description: Sandbox environment for development and testing
  - url: https://api.humanity.org/v2
    description: Production environment
security: []
tags: []
paths:
  /oauth/token:
    post:
      tags: []
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              oneOf:
                - type: object
                  properties:
                    grant_type:
                      const: authorization_code
                    code:
                      type: string
                    redirect_uri:
                      type: string
                    client_id:
                      type: string
                    code_verifier:
                      type: string
                  required:
                    - grant_type
                    - code
                    - redirect_uri
                    - client_id
                    - code_verifier
                - type: object
                  properties:
                    grant_type:
                      const: refresh_token
                    refresh_token:
                      type: string
                    client_id:
                      type: string
                    scope:
                      type: string
                  required:
                    - grant_type
                    - refresh_token
                    - client_id
        required: true
      responses:
        '200':
          description: ''
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
components:
  schemas:
    TokenResponse:
      type: object
      properties:
        access_token:
          type: string
        token_type:
          const: Bearer
        expires_in:
          type: number
        scope:
          type: string
        granted_scopes:
          type: array
          items:
            type: string
        authorization_id:
          type: string
        app_scoped_user_id:
          type: string
        issued_at:
          type: string
        refresh_token:
          type: string
        refresh_token_expires_in:
          type: number
        refresh_issued_at:
          type: string
        id_token:
          type: string
      required:
        - access_token
        - token_type
        - expires_in
        - scope
        - granted_scopes
        - authorization_id
        - app_scoped_user_id

````