> ## Documentation Index
> Fetch the complete documentation index at: https://docs.punchplay.tv/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange an authorization code or refresh token



## OpenAPI

````yaml /openapi.yaml post /api/platform/v1/oauth/token
openapi: 3.1.0
info:
  title: PunchPlay API
  version: 1.0.0-beta.3
  description: >-
    Complete beta contract for native and third-party clients, plus the stable
    read-only public profile API. OAuth access tokens use explicit per-operation
    scopes.
  summary: Platform and public API surface for PunchPlay developers.
servers:
  - url: https://punchplay.tv
    description: Production
  - url: http://localhost:3000
    description: Local development
security: []
tags:
  - name: Authentication
  - name: Profile
  - name: Titles
  - name: History
  - name: Ratings
  - name: Lists
  - name: Collection
  - name: Playback
  - name: Calendar
  - name: Community
  - name: Notifications
  - name: Trophies
  - name: Public Catalog
  - name: Public Users
paths:
  /api/platform/v1/oauth/token:
    post:
      tags:
        - Authentication
      summary: Exchange an authorization code or refresh token
      operationId: exchangeOAuthToken
      requestBody:
        $ref: '#/components/requestBodies/OAuthToken'
      responses:
        '200':
          $ref: '#/components/responses/TokenSuccess'
        '400':
          $ref: '#/components/responses/ApiError'
        '401':
          $ref: '#/components/responses/ApiError'
        '408':
          $ref: '#/components/responses/ApiError'
        '413':
          $ref: '#/components/responses/ApiError'
        '429':
          $ref: '#/components/responses/ApiError'
      security: []
components:
  requestBodies:
    OAuthToken:
      required: true
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/OAuthTokenInput'
        application/x-www-form-urlencoded:
          schema:
            $ref: '#/components/schemas/OAuthTokenInput'
  responses:
    TokenSuccess:
      description: Token response
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/TokenResponse'
      headers:
        X-RateLimit-Limit:
          schema:
            type: integer
          description: Ceiling of the most constraining bucket for this request.
        X-RateLimit-Remaining:
          schema:
            type: integer
          description: Requests remaining in the current window.
        X-RateLimit-Reset:
          schema:
            type: integer
          description: Unix time in seconds when the current window resets.
    ApiError:
      description: API error
      headers:
        X-PunchPlay-Request-Id:
          schema:
            type: string
        X-RateLimit-Limit:
          schema:
            type: integer
          description: Ceiling of the most constraining bucket for this request.
        X-RateLimit-Remaining:
          schema:
            type: integer
          description: Requests remaining in the current window.
        X-RateLimit-Reset:
          schema:
            type: integer
          description: Unix time in seconds when the current window resets.
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ApiError'
  schemas:
    OAuthTokenInput:
      type: object
      required:
        - client_id
        - grant_type
      properties:
        client_id:
          type: string
        client_secret:
          type: string
        grant_type:
          type: string
          enum:
            - authorization_code
            - refresh_token
        code:
          type: string
        code_verifier:
          type: string
        redirect_uri:
          type: string
          format: uri
        refresh_token:
          type: string
    TokenResponse:
      type: object
      required:
        - access_token
        - refresh_token
        - token_type
        - expires_in
        - refresh_expires_in
        - scope
      properties:
        access_token:
          type: string
        refresh_token:
          type: string
        token_type:
          type: string
          const: bearer
        expires_in:
          type: integer
        refresh_expires_in:
          type: integer
        scope:
          type: string
    ApiError:
      type: object
      required:
        - error
        - message
        - request_id
      properties:
        error:
          type: string
        message:
          type: string
        request_id:
          type:
            - string
            - 'null'
        required_scope:
          type: string
      additionalProperties: true

````