Request a Token

Exchanges an authorization code or refresh token for an access token. Use this endpoint after the Authorize step, or to refresh an expired access token.
Request Parameters
when grantType = AUTHORIZATION_CODE
grantTypestring
required
The authorization grant type.

Valid Values:

AUTHORIZATION_CODE — Exchange an authorization code for a token.
codestring
required
The authorization code received from the Authorize redirect callback. Maximum length: 256 characters. Valid for 10 minutes, single-use.
Response Parameters
resultResult
See Result.
accessTokenstring
The access token for making authenticated API calls.
expiresAtstring
The expiry time of the access token. ISO 8601 format (e.g., 2026-06-24T07:13:29Z).
refreshTokenstring
The refresh token for obtaining new access tokens. Returned when refresh is supported.
refreshTokenExpiresAtstring
The expiry time of the refresh token. Returned when refresh is supported. ISO 8601 format.
accountIdstring
The WorldFirst account ID that the token has access to. Maximum length: 64 characters.
scopestring
Space-separated list of granted permission scopes. See Scopes for supported scope values.
Error Codes
resultCoderesultStatusresultMessageTroubleshooting
SUCCESSSsuccessN/A
AUTH_CODE_NOT_EXISTFThe authorization code does not exist.
AUTH_CODE_EXPIREDFThe authorization code is expired.
Definition
POST /api/open/v1/oauth/token
Request
{
"grantType": "AUTHORIZATION_CODE",
"code": "TOKEN_TEST_zzzz****"
}
Response
{
"result": {
  "resultCode": "SUCCESS",
  "resultMessage": "success",
  "resultStatus": "S"
},
"accessToken": "TOKEN_TEST_yyyy****",
"refreshToken": "TOKEN_TEST_xxxx****",
"expiresAt": "2026-06-25T07:13:29Z",
"refreshTokenExpiresAt": "2026-07-24T07:13:29Z",
"scope": "balances:read payouts:write",
"accountId": "2024****"
}