> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lojou.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange an authorization code for an access token

> Second step of the OAuth flow: exchange the `code` your app received
on the redirect callback for a long-lived access token. The `code`
is single-use and expires 10 minutes after the store owner
authorizes your app. See the [OAuth guide](/oauth) for the full flow
(registering an app, sending the seller to authorize, and handling
the callback).




## OpenAPI

````yaml /openapi.yaml post /v1/oauth/token
openapi: 3.1.0
info:
  title: Lojou API
  version: 1.0.0
  description: |
    Official reference for the Lojou `/v1` API — everything a developer needs
    to create products, process orders, manage plans, and receive webhooks
    from a Lojou store.
servers:
  - url: https://api.lojou.app
    description: Production
security:
  - bearerAuth: []
tags:
  - name: Health
  - name: OAuth
  - name: User
  - name: Products
  - name: Plans
  - name: Orders
  - name: Customers
  - name: Files
  - name: Webhooks
  - name: Discounts
  - name: Affiliates
paths:
  /v1/oauth/token:
    post:
      tags:
        - OAuth
      summary: Exchange an authorization code for an access token
      description: |
        Second step of the OAuth flow: exchange the `code` your app received
        on the redirect callback for a long-lived access token. The `code`
        is single-use and expires 10 minutes after the store owner
        authorizes your app. See the [OAuth guide](/oauth) for the full flow
        (registering an app, sending the seller to authorize, and handling
        the callback).
      operationId: postV1OauthToken
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OauthTokenRequest'
      responses:
        '200':
          description: Token issued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OauthTokenResponse'
              example:
                access_token: aB3xY9k2mZ7...
                refresh_token: rT8pL1qN4wV...
                token_type: Bearer
                expires_in: 2592000
                expires_at: '2026-09-30T12:00:00.000000Z'
                permissions:
                  - orders.read
                  - products.read
        '401':
          description: Invalid code, expired code, or invalid client credentials
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
              example:
                status: error
                message: Código inválido ou expirado
        '422':
          $ref: '#/components/responses/ValidationError'
      security: []
components:
  schemas:
    OauthTokenRequest:
      type: object
      required:
        - code
        - client_id
        - client_secret
        - redirect_uri
        - state
      properties:
        code:
          type: string
          description: >-
            Authorization code received on the redirect callback after the
            seller approved your app.
        client_id:
          type: string
        client_secret:
          type: string
        redirect_uri:
          type: string
          format: uri
          description: Must match exactly the redirect_uri your app was registered with.
        state:
          type: string
          description: >-
            The same `state` value that came back with the authorization code,
            echoed back for CSRF protection.
    OauthTokenResponse:
      type: object
      properties:
        access_token:
          type: string
        refresh_token:
          type: string
        token_type:
          type: string
          example: Bearer
        expires_in:
          type: integer
          description: Seconds until the access token expires.
          example: 2592000
        expires_at:
          type: string
          format: date-time
        permissions:
          type: array
          items:
            type: string
          description: >-
            Scopes granted to your app by the store owner (a subset of the app's
            requested permissions).
    ErrorResponse:
      type: object
      properties:
        status:
          type: string
          example: error
        message:
          type: string
      additionalProperties: true
    ValidationErrorResponse:
      allOf:
        - $ref: '#/components/schemas/ErrorResponse'
        - type: object
          properties:
            errors:
              type: object
              additionalProperties:
                type: array
                items:
                  type: string
  responses:
    ValidationError:
      description: Validation failed
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ValidationErrorResponse'
          example:
            status: error
            message: Validation failed.
            errors:
              amount:
                - The amount field is required.
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: |
        Send an API key or an OAuth access token in the `Authorization` header
        as a Bearer token. See [Authentication](/authentication) for details.

````