Connected App Access Token Exchange

Exchange Access Token

POST

https://test.stytch.com/v1/b2b/sessions/exchange_access_token

Use this endpoint to exchange a Connected Apps Access Token back into a Member Session for the underlying Member. This session can be used with the Stytch SDKs and APIs.

The Access Token must contain the full_access scope (only available to First Party clients) and must not be more than 5 minutes old. Access Tokens may only be exchanged a single time.

The Member Session returned will be the same Member Session that was active in your application (the authorizing party) during the initial authorization flow.

Because the Member previously completed MFA and satisfied all Organization authentication requirements at the time of the original Access Token issuance, this endpoint will never return an intermediate_session_token or require MFA.

Body parameters

access_token* string

session_duration_minutes int

session_custom_claims map<string, any>

Response fields

request_id string

status_code int

member_id string

session_token string

session_jwt string

member_session object

member object

organization object

const stytch = require('stytch');

const client = new stytch.B2BClient({
  project_id: 'PROJECT_ID',
  secret: 'SECRET',
});

const params = {
  access_token: "eyJ...",
};

client.sessions.exchangeAccessToken(params)
  .then(resp => { console.log(resp) })
  .catch(err => { console.log(err) });

RESPONSE

{
	"request_id": "request-id-test-b05c992f-ebdc-489d-a754-c7e70ba13141",
	"status_code": 200,
	"member_id": "member-test-32fc5024-9c09-4da3-bd2e-c9ce4da9375f",
	"session_jwt": "example_jwt",
	"session_token": "mZAYn5aLEqKUlZ_Ad9U_fWr38GaAQ1oFAhT8ds245v7Q",
	"member_session": {...},
	"member": {...},
	"organization": {...}
}

Delete

Organization

Discovery

Organization

Discovery

Discovery

Organization

Token

SAML

OIDC

External

Shared

Connection management

Token management

SCIM groups

Create or Reset Options

One-time passcodes

Time-based one-time passcodes

Recovery codes

TOKEN

M2M Client

Rotate secret

Tokens

Configuration

Methods

Management

Exchange Access Token

Body parameters

Response fields

Common Error Types