Code exchange
Client credentials are in the JSON body, not Basic auth. One-time redemption; no automatic retries after ambiguous failure. Token expires in 900 seconds.
On this page
https://api.anyoauth.com/v1/tokenAuthentication: Client ID and secret in JSON; confidential backend only.
Request
Content type: application/json.
| Field | Type | Required | Description and constraints |
|---|---|---|---|
grant_type | "authorization_code" | Yes | |
client_id | string | Yes | maxLength: 100 |
client_secret | string | Yes | minLength: 1; maxLength: 200 |
code | string | Yes | minLength: 1; maxLength: 200 |
redirect_uri | string | Yes | Exact registered HTTPS URL or HTTP loopback; no credentials, query or fragment. maxLength: 2048; format: uri; x-validation: redirect |
code_verifier | string | Yes | pattern: ^[A-Za-z0-9._~-]{43,128}$ |
{
"grant_type": "authorization_code",
"client_id": "YOUR_CLIENT_ID",
"client_secret": "YOUR_CLIENT_SECRET",
"code": "CALLBACK_CODE",
"redirect_uri": "https://your-app.example/auth/callback",
"code_verifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
}SDK and HTTP examples
import { AnyOAuth } from "@anyoauth/node";
const client = new AnyOAuth({
clientId: process.env.ANYOAUTH_CLIENT_ID ?? "YOUR_CLIENT_ID",
clientSecret: process.env.ANYOAUTH_CLIENT_SECRET ?? "YOUR_CLIENT_SECRET",
baseUrl: process.env.ANYOAUTH_API_ORIGIN ?? "https://api.anyoauth.com",
});
const token = await client.exchangeCode({
code: process.env.ANYOAUTH_CODE ?? "CALLBACK_CODE",
redirectUri: process.env.ANYOAUTH_REDIRECT_URI ?? "https://your-app.example/auth/callback",
codeVerifier: process.env.ANYOAUTH_CODE_VERIFIER ?? "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
});
@anyoauth/node on GitHubConfidential backend SDK
import os
from anyoauth import Client
client = Client(os.getenv("ANYOAUTH_CLIENT_ID", "YOUR_CLIENT_ID"), os.getenv("ANYOAUTH_CLIENT_SECRET", "YOUR_CLIENT_SECRET"), os.getenv("ANYOAUTH_API_ORIGIN", "https://api.anyoauth.com"))
token = client.exchange_code({"code": os.getenv("ANYOAUTH_CODE", "CALLBACK_CODE"), "redirectUri": os.getenv("ANYOAUTH_REDIRECT_URI", "https://your-app.example/auth/callback"), "codeVerifier": os.getenv("ANYOAUTH_CODE_VERIFIER", "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk")})
anyoauth-sdk on GitHubConfidential backend SDK
package main
import (
"os"
anyoauth "github.com/AnyOAuth/anyoauth-go"
)
func env(key, fallback string) string { if v := os.Getenv(key); v != "" { return v }; return fallback }
func main() {
client, err := anyoauth.NewClient(env("ANYOAUTH_API_ORIGIN", "https://api.anyoauth.com"), env("ANYOAUTH_CLIENT_ID", "YOUR_CLIENT_ID"), env("ANYOAUTH_CLIENT_SECRET", "YOUR_CLIENT_SECRET"))
if err != nil { panic(err) }
token, err := client.ExchangeCode(map[string]any{"code": env("ANYOAUTH_CODE", "CALLBACK_CODE"), "redirectUri": env("ANYOAUTH_REDIRECT_URI", "https://your-app.example/auth/callback"), "codeVerifier": env("ANYOAUTH_CODE_VERIFIER", "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk")})
if err != nil { panic(err) }
_ = token
}
github.com/AnyOAuth/anyoauth-go on GitHubConfidential backend SDK
<?php
require 'vendor/autoload.php';
$client = new \AnyOAuth\Client((getenv("ANYOAUTH_CLIENT_ID") ?: "YOUR_CLIENT_ID"), (getenv("ANYOAUTH_CLIENT_SECRET") ?: "YOUR_CLIENT_SECRET"), (getenv("ANYOAUTH_API_ORIGIN") ?: "https://api.anyoauth.com"));
$token = $client->exchangeCode(["code" => (getenv("ANYOAUTH_CODE") ?: "CALLBACK_CODE"), "redirectUri" => (getenv("ANYOAUTH_REDIRECT_URI") ?: "https://your-app.example/auth/callback"), "codeVerifier" => (getenv("ANYOAUTH_CODE_VERIFIER") ?: "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk")]);
anyoauth/anyoauth on GitHubConfidential backend SDK
import com.anyoauth.AnyOAuth;
import com.google.gson.*;
public class Example {
static String env(String key, String fallback) { String value = System.getenv(key); return value == null ? fallback : value; }
public static void main(String[] args) {
AnyOAuth client = new AnyOAuth(env("ANYOAUTH_API_ORIGIN", "https://api.anyoauth.com"), env("ANYOAUTH_CLIENT_ID", "YOUR_CLIENT_ID"), env("ANYOAUTH_CLIENT_SECRET", "YOUR_CLIENT_SECRET"));
JsonObject params = new JsonObject();
params.addProperty("code", env("ANYOAUTH_CODE", "CALLBACK_CODE"));
params.addProperty("redirectUri", env("ANYOAUTH_REDIRECT_URI", "https://your-app.example/auth/callback"));
params.addProperty("codeVerifier", env("ANYOAUTH_CODE_VERIFIER", "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"));
var token = client.exchangeCode(params);
}
}
com.anyoauth:anyoauth on GitHubConfidential backend SDK
require "anyoauth"
client = AnyOAuth::Client.new(ENV.fetch("ANYOAUTH_CLIENT_ID", "YOUR_CLIENT_ID"), ENV.fetch("ANYOAUTH_CLIENT_SECRET", "YOUR_CLIENT_SECRET"), ENV.fetch("ANYOAUTH_API_ORIGIN", "https://api.anyoauth.com"))
token = client.exchange_code({"code" => ENV.fetch("ANYOAUTH_CODE", "CALLBACK_CODE"), "redirectUri" => ENV.fetch("ANYOAUTH_REDIRECT_URI", "https://your-app.example/auth/callback"), "codeVerifier" => ENV.fetch("ANYOAUTH_CODE_VERIFIER", "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk")})
anyoauth-sdk on GitHubConfidential backend SDK
using System;
using System.Text.Json.Nodes;
using AnyOAuth;
using var client = new Client(Environment.GetEnvironmentVariable("ANYOAUTH_API_ORIGIN") ?? "https://api.anyoauth.com", Environment.GetEnvironmentVariable("ANYOAUTH_CLIENT_ID") ?? "YOUR_CLIENT_ID", Environment.GetEnvironmentVariable("ANYOAUTH_CLIENT_SECRET") ?? "YOUR_CLIENT_SECRET");
var token = await client.ExchangeCode(new JsonObject { ["code"] = Environment.GetEnvironmentVariable("ANYOAUTH_CODE") ?? "CALLBACK_CODE", ["redirectUri"] = Environment.GetEnvironmentVariable("ANYOAUTH_REDIRECT_URI") ?? "https://your-app.example/auth/callback", ["codeVerifier"] = Environment.GetEnvironmentVariable("ANYOAUTH_CODE_VERIFIER") ?? "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk" });
AnyOAuth.SDK on GitHubConfidential backend SDK
use anyoauth_sdk::*;
use serde_json::json;
fn env(key: &str, fallback: &str) -> String { std::env::var(key).unwrap_or_else(|_| fallback.to_owned()) }
fn main() -> Result<(), Box<dyn std::error::Error>> {
let client = Client::new(&env("ANYOAUTH_API_ORIGIN", "https://api.anyoauth.com"), &env("ANYOAUTH_CLIENT_ID", "YOUR_CLIENT_ID"), &env("ANYOAUTH_CLIENT_SECRET", "YOUR_CLIENT_SECRET"))?;
let token = client.exchange_code(&json!({"code": env("ANYOAUTH_CODE", "CALLBACK_CODE"), "redirectUri": env("ANYOAUTH_REDIRECT_URI", "https://your-app.example/auth/callback"), "codeVerifier": env("ANYOAUTH_CODE_VERIFIER", "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk")}))?;
let _ = &token;
Ok(())
}
anyoauth-sdk on GitHubConfidential backend SDK
client = AnyOAuth.new((System.get_env("ANYOAUTH_CLIENT_ID") || "YOUR_CLIENT_ID"), (System.get_env("ANYOAUTH_CLIENT_SECRET") || "YOUR_CLIENT_SECRET"), (System.get_env("ANYOAUTH_API_ORIGIN") || "https://api.anyoauth.com"))
token = AnyOAuth.exchange_code(client, %{"code" => (System.get_env("ANYOAUTH_CODE") || "CALLBACK_CODE"), "redirectUri" => (System.get_env("ANYOAUTH_REDIRECT_URI") || "https://your-app.example/auth/callback"), "codeVerifier" => (System.get_env("ANYOAUTH_CODE_VERIFIER") || "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk")})
anyoauth_sdk on GitHubConfidential backend SDK
curl --request POST 'https://api.anyoauth.com/v1/token' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--data-binary @- <<JSON
{
"grant_type": "authorization_code",
"client_id": "${ANYOAUTH_CLIENT_ID}",
"client_secret": "${ANYOAUTH_CLIENT_SECRET}",
"code": "${ANYOAUTH_CODE}",
"redirect_uri": "${ANYOAUTH_REDIRECT_URI}",
"code_verifier": "${ANYOAUTH_CODE_VERIFIER}"
}
JSON
HTTP reference · keep credentials on your backend
Sample input bindings are illustrative. In a callback handler, take code and transaction values from the validated request and initiating session. Client-only SDKs do not perform confidential exchange.
Response
Success status: 200.
| Field | Type | Required | Description and constraints |
|---|---|---|---|
access_token | string | Yes | pattern: ^aop_[A-Za-z0-9_-]{43}$ |
token_type | "Bearer" | Yes | |
expires_in | 900 | Yes | |
scope | "profile" | Yes |
{
"access_token": "aop_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"token_type": "Bearer",
"expires_in": 900,
"scope": "profile"
}Errors
Application errors use the shared error model. Infrastructure may return non-JSON responses; SDKs expose structured transport/protocol errors. Do not automatically retry a one-time code exchange.
| Field | Type | Required | Description and constraints |
|---|---|---|---|
error | string | Yes | |
message | string | No |
{
"error": "request_failed",
"message": "The request could not be completed."
}Contract source
This page, its field tables and sample inputs derive from OpenAPI version 0.1.0. Download OpenAPI · Download JSON Schema · Request schema · Response schema