Exchange Code for Tokens

Server-to-server call. Exchange the authorization code for an access_token. Use the access_token as a Bearer token in the Authorization header when calling API endpoints.

POST/api/oauth/token

Authentication

OAuthAuthorization: Bearer

Uses client_id + client_secret in the request body (not headers).

Query Parameters

grant_typestring

required

Must be 'authorization_code'

Default:authorization_code

codestring

required

The authorization code from the callback redirect

client_idstring

required

From Partner Account → Manage Apps → View Credentials

client_secretstring

required

From Partner Account → Manage Apps → View Credentials

redirect_uristring

optional

Must match the URI used in the authorize step

Responses

200Success

application/json

access_tokenstring

token_typestring

scopestring

Complete the authorization flow

Use this endpoint after the user returns to your registered callback with an authorization code. Send the exchange from your backend to login.pandaidx.com. The request body contains the code, grant type and your application's client credentials. If you include redirect_uri, use the same value as in the authorization step. Keep the authorization callback and the token exchange associated with the same user session.

Store and use the token safely

Keep client_secret and returned tokens on your server. Do not embed them in website JavaScript, public repositories, analytics events or browser URLs. Once the exchange succeeds, send the access token in the Authorization: Bearer header for product API requests. The authorization URL, token endpoint and product API have different roles; use the base URL shown for each request.

Verify the connection

Call Get Current User with the returned access token before fetching listings or contacts. Review the application and granted scopes in that response so your integration operates on the intended website. If the exchange fails, inspect the HTTP response and validate the client credentials, callback URI and authorization code before retrying. Redact secrets when collecting diagnostic logs.

OAuth authorization · Check the connected account · API setup guide

Request

curl --request POST \
  --url "https://api.pandaidx.com/api/oauth/token" \
  --header "Content-Type: application/json" \
  --data-raw '{
    "grant_type": "authorization_code",
    "code": "{{auth_code}}",
    "client_id": "{{client_id}}",
    "client_secret": "{{client_secret}}",
    "redirect_uri": "{{redirect_uri}}"
  }'

Response200 OK

{
  "access_token": "64-char-hex-access-token",
  "token_type": "Bearer",
  "scope": "listings,contacts,analytics"
}