Use this endpoint to exchange a Connected Apps Access Token back into a Stytch Session for the underlying User. This session can be used with the Stytch SDKs and APIs.
The Session returned will be the same Session that was active in your application (the authorizing party) during the initial authorization flow.
The Access Token must contain the full_access scope (only available to First Party clients) and must not be more than 5 minutes old. Access Tokens may only be exchanged a single time.
const stytch = require('stytch');
const client = new stytch.Client({
project_id: 'PROJECT_ID',
secret: 'SECRET',
});
const params = {
access_token: "eyJ...",
};
client.sessions.exchangeAccessToken(params)
.then(resp => { console.log(resp) })
.catch(err => { console.log(err) });{
"request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
"status_code": 200,
"user_id": "user-test-16d9ba61-97a1-4ba4-9720-b03761dc50c6",
"session_jwt": "example_jwt",
"session_token": "mZAYn5aLEqKUlZ_Ad9U_fWr38GaAQ1oFAhT8ds245v7Q",
"session": {...},
"user": {...}
}