Exchange code for tokens

POST/oauth2/token

Exchange an authorization code for an access token and a refresh token.

The token endpoint, called with grant_type=authorization_code. Send the code returned by the Qashio login flow, together with the redirect_uri it was issued against, and Qashio returns an access token and a refresh token. To rotate an expiring token, call the same URL with grant_type=refresh_token: see Refresh access token.

Your client_id and client_secret are required. These are confidential client credentials and must never be used from a browser or mobile app.

Authorization codes are single use and expire after ten minutes. Exchange one as soon as it arrives.

This endpoint does not use the standard response envelope.

Request body

application/jsonrequired

Field	Type	Description
`grant_type`	string	Always `authorization_code`. Required
`client_id`	string	Your client identifier. Required
`client_secret`	string	Your client secret. Required
`code`	string	The authorization code. Required
`redirect_uri`	string	The redirect URI used to obtain the code; must match exactly. Required

JSON

{
  "grant_type": "authorization_code",
  "code": "AUTHORIZATION_CODE",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET",
  "redirect_uri": "https://app.example.com/callback"
}

Response

200 with the token set.

Field	Type	Description
`access_token`	string	Bearer token to send on API requests
`token_type`	string	Always `Bearer`
`refresh_token`	string	Send this to Refresh access token before the access token expires
`scope`	string	Space-separated scopes granted, e.g. `cards:read cards:write transactions:read`

Response schema from the OpenAPI document

Field	Type	Description
`access_token`	string
`token_type`	string
`refresh_token`	string
`scope`	string

Errors

Status	Cause
`400`	Missing or unsupported parameters, or `redirect_uri` does not match the one used at authorization
`401`	Authorization code invalid, expired or already used; invalid client credentials

400Invalid grant / missing client credentials
401Invalid client, or authorization code invalid, expired or already used

Every error carries an errors[] array and a meta.request_id. See Errors for the full envelope.

POST/oauth2/token

curl -X POST 'https://api.qashio.com/oauth2/token' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
    "grant_type": "authorization_code",
    "code": "AUTHORIZATION_CODE",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "redirect_uri": "https://app.example.com/callback"
  }'

const accessToken = process.env.QASHIO_ACCESS_TOKEN;

const response = await fetch('https://api.qashio.com/oauth2/token', {
  method: 'POST',
  headers: {
    Accept: 'application/json',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "grant_type": "authorization_code",
    "code": "AUTHORIZATION_CODE",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "redirect_uri": "https://app.example.com/callback"
  }),
});

if (!response.ok) {
  throw new Error(`Qashio API ${response.status}: ${await response.text()}`);
}

const { data, meta } = await response.json();
console.log(meta.request_id, data);

import https from 'node:https';

const url = new URL('https://api.qashio.com/oauth2/token');

const payload = await new Promise((resolve, reject) => {
  const req = https.request(
    url,
    {
      method: 'POST',
      headers: {
      Accept: 'application/json',
        'Content-Type': 'application/json',
      },
    },
    (res) => {
      let raw = '';
      res.on('data', (chunk) => (raw += chunk));
      res.on('end', () => resolve(JSON.parse(raw)));
    },
  );
  req.on('error', reject);
  req.write(JSON.stringify({
    "grant_type": "authorization_code",
    "code": "AUTHORIZATION_CODE",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "redirect_uri": "https://app.example.com/callback"
  }));
  req.end();
});

console.log(payload.data);

import os
import requests

url = "https://api.qashio.com/oauth2/token"
headers = {
    "Accept": "application/json",
}

payload = {
  "grant_type": "authorization_code",
  "code": "AUTHORIZATION_CODE",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET",
  "redirect_uri": "https://app.example.com/callback"
}

response = requests.post(url, headers=headers, json=payload, timeout=30)
response.raise_for_status()

body = response.json()
print(body["meta"]["request_id"], body["data"])

<?php

$ch = curl_init('https://api.qashio.com/oauth2/token');

curl_setopt_array($ch, [
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_CUSTOMREQUEST  => 'POST',
  CURLOPT_HTTPHEADER     => [
      'Accept: application/json',
      'Content-Type: application/json',
  ],
  CURLOPT_POSTFIELDS     => json_encode([
  'grant_type' => 'authorization_code',
  'code' => 'AUTHORIZATION_CODE',
  'client_id' => 'YOUR_CLIENT_ID',
  'client_secret' => 'YOUR_CLIENT_SECRET',
  'redirect_uri' => 'https://app.example.com/callback'
]),
]);

$response = curl_exec($ch);
curl_close($ch);

$body = json_decode($response, true);
print_r($body['data']);

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"net/http"
	"os"
)

func main() {
	payload := []byte(`{
  "grant_type": "authorization_code",
  "code": "AUTHORIZATION_CODE",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET",
  "redirect_uri": "https://app.example.com/callback"
}`)

	req, _ := http.NewRequest("POST", "https://api.qashio.com/oauth2/token", bytes.NewBuffer(payload))
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Content-Type", "application/json")

	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()

	var out map[string]any
	json.NewDecoder(res.Body).Decode(&out)
	fmt.Println(out["data"])
}

require 'net/http'
require 'json'
require 'uri'

uri = URI('https://api.qashio.com/oauth2/token')
request = Net::HTTP::Post.new(uri)
request['Accept'] = 'application/json'
request['Content-Type'] = 'application/json'
request.body = "{\n  \"grant_type\": \"authorization_code\",\n  \"code\": \"AUTHORIZATION_CODE\",\n  \"client_id\": \"YOUR_CLIENT_ID\",\n  \"client_secret\": \"YOUR_CLIENT_SECRET\",\n  \"redirect_uri\": \"https://app.example.com/callback\"\n}"

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == 'https') do |http|
  http.request(request)
end

body = JSON.parse(response.body)
puts body['data']

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class QashioExample {
  public static void main(String[] args) throws Exception {
    String payload = """
      {
        "grant_type": "authorization_code",
        "code": "AUTHORIZATION_CODE",
        "client_id": "YOUR_CLIENT_ID",
        "client_secret": "YOUR_CLIENT_SECRET",
        "redirect_uri": "https://app.example.com/callback"
      }
      """;

    HttpRequest request = HttpRequest.newBuilder()
        .uri(URI.create("https://api.qashio.com/oauth2/token"))
        .header("Accept", "application/json")
        .header("Content-Type", "application/json")
        .method("POST", HttpRequest.BodyPublishers.ofString(payload))
        .build();

    HttpResponse<String> response = HttpClient.newHttpClient()
        .send(request, HttpResponse.BodyHandlers.ofString());

    System.out.println(response.body());
  }
}

using System;
using System.Net.Http;
using System.Text;
using System.Threading.Tasks;

var client = new HttpClient();

var request = new HttpRequestMessage(new HttpMethod("POST"), "https://api.qashio.com/oauth2/token");
request.Headers.Add("Accept", "application/json");

var payload = @"{
  ""grant_type"": ""authorization_code"",
  ""code"": ""AUTHORIZATION_CODE"",
  ""client_id"": ""YOUR_CLIENT_ID"",
  ""client_secret"": ""YOUR_CLIENT_SECRET"",
  ""redirect_uri"": ""https://app.example.com/callback""
}";
request.Content = new StringContent(payload, Encoding.UTF8, "application/json");

var response = await client.SendAsync(request);
response.EnsureSuccessStatusCode();

Console.WriteLine(await response.Content.ReadAsStringAsync());

import Foundation

var request = URLRequest(url: URL(string: "https://api.qashio.com/oauth2/token")!)
request.httpMethod = "POST"
request.setValue("application/json", forHTTPHeaderField: "Accept")
request.setValue("application/json", forHTTPHeaderField: "Content-Type")
request.httpBody = """
{
  "grant_type": "authorization_code",
  "code": "AUTHORIZATION_CODE",
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET",
  "redirect_uri": "https://app.example.com/callback"
}
""".data(using: .utf8)

let (data, _) = try await URLSession.shared.data(for: request)
print(String(data: data, encoding: .utf8)!)

Response

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJDTzl5eTBtZnpxaHh0eGtrayIsImNvbXBhbnlfaWQiOiJDTzl5eTBtZnpxaHh0eGtrayIsInNjb3BlIjoiZXJwIiwiaWF0IjoxNzU3NDk3OTgwLCJleHAiOjE3NTc0OTg4ODB9...",
  "token_type": "Bearer",
  "refresh_token": "rt_8f3a1c9e2b7d4a6c0e5f9b1d3a7c2e4f8a0b1c2d...",
  "scope": "wallet:read cards:read cards:write transactions:read transactions:write users:read..."
}

{
  "status_code": 401,
  "success": false,
  "message": "Missing Bearer token",
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing Bearer token"
  },
  "errors": [
    {
      "code": "UNAUTHORIZED",
      "message": "Missing Bearer token",
      "field": "authorization"
    }
  ],
  "meta": {
    "request_id": "3adb2d16090c7b3bdbde3b326a814b30",
    "timestamp": "2026-09-09T10:07:52.143Z"
  }
}

{
  "status_code": 401,
  "success": false,
  "message": "Missing Bearer token",
  "error": {
    "code": "UNAUTHORIZED",
    "message": "Missing Bearer token"
  },
  "errors": [
    {
      "code": "UNAUTHORIZED",
      "message": "Missing Bearer token",
      "field": "authorization"
    }
  ],
  "meta": {
    "request_id": "3adb2d16090c7b3bdbde3b326a814b30",
    "timestamp": "2026-09-09T10:07:52.143Z"
  }
}