Skip to main content
POST
Exchange an authorization code for an access token
The user approved your app and PostQueen sent them back to you with a code on the query string. Trade it here for the pos_ token you will use on every call after this one. Two things about that code are worth planning around. It is good for ten minutes, and it works exactly once, because the exchange clears it as it hands you the token. Run the same request twice and the second one comes back as invalid_grant.
Make this call from your server. It carries your client secret, which never belongs in a browser or a mobile binary. A wrong secret and an unknown client_id both answer 401 with invalid_client, so the response will not tell you which of the two you got wrong.
The token that comes back does not expire on a clock. It stops working when the user revokes your app from Settings > Approved Apps. Full flow, including how to register the app in the first place, on OAuth2 Authentication.

Body

application/json
grant_type
enum<string>
required

Must be authorization_code

Available options:
authorization_code
code
string
required

The authorization code from your callback URL

client_id
string
required

Your app's Client ID (starts with pca_)

client_secret
string
required

Your app's Client Secret (starts with pcs_)

Response

Access token issued

id
string

Organization ID of the user who authorized your app

cus
string | null

The organization's Stripe customer ID, or null when it has none

access_token
string

The token to send in the Authorization header (starts with pos_)

token_type
string

Always bearer