Exchange an authorization code for an access token
Exchange Code for Token
Exchanges the authorization code from your callback for a pos_ access token. Call this from your server, since it requires your client secret. The code expires 10 minutes after it is issued and can only be used once. The access token does not expire; users revoke it from Settings > Approved Apps.
This endpoint lives outside /public/v1 and takes no API key. The token it returns is used as the Authorization header on every other endpoint in this reference.
POST
Exchange an authorization code for an access token
The user approved your app and PostQueen sent them back to you with a code on the query string. Trade it here for the
pos_ token you will use on every call after this one.
Two things about that code are worth planning around. It is good for ten minutes, and it works exactly once, because the exchange clears it as it hands you the token. Run the same request twice and the second one comes back as invalid_grant.
The token that comes back does not expire on a clock. It stops working when the user revokes your app from Settings > Approved Apps. Full flow, including how to register the app in the first place, on OAuth2 Authentication.Body
application/json