# Access token

## POST /api-gw/oauth/token

Access token

Exchange the authorization code received from the OAuth redirect callback for an access token.

**Token lifetime:** The returned access token is valid for **24 hours**. After expiry, the token is silently rejected with a `401 Unauthorized`. Re-authenticate by repeating the full authorization flow.

**Re-authentication flow:** `GET /api-gw/oauth/authorize` → user login → redirect with code → `POST /api-gw/oauth/token`.

### Request Body (application/x-www-form-urlencoded)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| code | string | Yes | This field value will be same as code received in the final redirection callback. |
| client_id | string | Yes | Your app's alphanumeric API key from the [Apps Section](https://developer.tradejini.com/developer-portal) app registration page. Must match the key used in Step 1 (`/authorize`). If it does not match, access token generation will fail. |
| redirect_uri | string | Yes | This field value should be the redirect url mentioned in the registered app. If the value is improper access token will not be generated. |
| client_secret | string | Yes | Your app's API secret, obtained from the [Apps Section](https://developer.tradejini.com/developer-portal) app registration page. If the value does not match, access token generation will fail. |
| grant_type | string ("authorization_code") | Yes | As per oAuth specification this value should be __"authorization_code"__ |

### Responses

#### 200 — OK

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| access_token | string | No | The access token to include in the `Authorization` header of all subsequent API requests. Format: `Bearer <api_key>:<access_token>`. |
| token_type | string | No | Token type. Always `"bearer"`. |
| expires_in | integer | No | Token lifetime in seconds. Typically `86400` (24 hours). After expiry the API returns `401 Unauthorized` — re-authenticate to get a new token. |
| scope | string | No | OAuth scope granted to the token. |

#### 400 — Bad Request — missing or invalid `code` or `redirect_uri`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| s | string ("error") | No | Response status. Always `error` for error responses. |
| msg | string ("Internal Error occurred. Kindly try again." | "Input validation failed. Kindly check your input contains required fields for the request") | No | Error message describing which field failed validation or why the request was rejected. |

#### 401 — Unauthorized — invalid or expired authorization code

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| s | string ("error") | No | Response status. Always `error` for error responses. |
| msg | string ("Unauthorized") | No | Error message. |

#### 429 — Too Many Requests — rate limit exceeded (100 req/sec per API key)

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| s | string ("error") | No | Response status. Always `error` for error responses. |
| msg | string | No | Error message indicating the rate limit was exceeded. |

#### 500 — Internal Server Error — retry with backoff

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| s | string ("error") | No | Response status. Always `error` for error responses. |
| msg | string | No | Error message. |