# Exchange code for token (deprecated)

Retrieve ID and access tokens. This API is used to retrieve ID and access tokens using the code that was returned in the redirect URI as a query parameter (for example, when the user clicks a magic link). It may also create a new user if create_new_user was set to true in the send request and no user exists for the email address or phone number (depending on the flow).

Endpoint: POST /v1/token

## Request fields (application/json):

  - `code` (string, required)
    Authorization code returned in the redirect URI as a query parameter upon successful authentication
    Example: GZxLFKTDCnlANVTxNvaWz7AIGPpXqZYSXdAwjiWRuOH

  - `client_id` (string, required)
    Client ID of the application requesting the token
    Example: DgsdfhSDsdfhtSDFXCCXBVMKPws345yscv2345XCZV

  - `client_secret` (string, required)
    Client Secret of the application requesting the token
    Example: FzxvdDMbvxnc45sdfb789XCVGEW6usazxcvbw3KPsb23

## Response 200 fields (application/json):

  - `id_token` (string, required)

  - `access_token` (string, required)

  - `refresh_token` (string, required)

  - `is_user_created` (boolean, required)
    Indicates if this is a new user or not

## Response 400 fields (application/json):

  - `message` (array, required)
    Example: Bad request

  - `error_code` (number, required)
    Example: 400