> ## Documentation Index > Fetch the complete documentation index at: https://docs2.finverse.com/llms.txt > Use this file to discover all available pages before exploring further. # Exchange Link Code for login_identity_token and login_identity_id > Exchange the one-time auth `code` (from a successful Finverse linking redirect) for a `login_identity_token` and its associated `login_identity_refresh_token`. Note: a Login Identity represents a unique financial institution authenticated account linked by the end-user. An end-user who links multiple Institutions (or multiple authenticated accounts at the same Institution), will have a distinct Login Identity for each linked account. **Important:** make sure to use the Header `Content-Type: application/x-www-form-urlencoded` for this request (in accordance with OAuth specification for code exchange) **Authorization**: `customer_token` ## Token handling ### Storage `login_identity_token` and `login_identity_refresh_token` are highly sensitive as they are needed to retrieve data on each Login Identity. Best practices: \* Securely store each token in your back-end \* Never disclose the tokens externally (e.g. in your front-end). ### Renewal `login_identity_token` expires after 1 hour. `login_identity_refresh_token` expires after 90 days. Implement `POST /auth/token/refresh` for token renewal. ## OpenAPI ````yaml /api-reference/openapi.json post /auth/token openapi: 3.0.0 info: description: Documentation of the early finverse services title: Finverse Public termsOfService: https://example.com contact: name: Maintainers email: info@finverse.com license: name: unknown license version: 0.0.1 servers: - url: https://api.prod.finverse.net security: - Oauth2: - test tags: - name: public description: Publicly accessible endpoints x-group: Public - name: customer description: Customer app and institution endpoints x-group: Customer - name: link description: Finverse Link flows x-group: Link - name: login_identity description: Login identity lifecycle and metadata x-group: Login identity - name: accounts description: Accounts, balances, and account numbers x-group: Accounts - name: statements description: Statements and composite statements x-group: Statements - name: transactions description: Transaction history x-group: Transactions - name: identity_income description: Identity and income insights x-group: Identity & income - name: payment_links description: Payment link creation and checkout x-group: Payment links - name: mandates description: Direct debit mandates x-group: Mandates - name: payments description: Payment initiation and status x-group: Payment operations - name: payouts description: Payouts and scheduled payouts x-group: Payouts - name: payment_users description: Payment user profiles x-group: Payment users - name: payment_accounts description: Payment accounts for users x-group: Payment accounts - name: payment_methods description: Stored payment methods x-group: Payment methods - name: bills description: Bill presentment x-group: Bills - name: disputes description: Payment disputes x-group: Disputes - name: ledger description: Ledger and statements x-group: Ledger paths: /auth/token: post: tags: - link summary: Exchange Link Code for login_identity_token and login_identity_id description: >- Exchange the one-time auth `code` (from a successful Finverse linking redirect) for a `login_identity_token` and its associated `login_identity_refresh_token`. Note: a Login Identity represents a unique financial institution authenticated account linked by the end-user. An end-user who links multiple Institutions (or multiple authenticated accounts at the same Institution), will have a distinct Login Identity for each linked account. **Important:** make sure to use the Header `Content-Type: application/x-www-form-urlencoded` for this request (in accordance with OAuth specification for code exchange) **Authorization**: `customer_token` ## Token handling ### Storage `login_identity_token` and `login_identity_refresh_token` are highly sensitive as they are needed to retrieve data on each Login Identity. Best practices: \* Securely store each token in your back-end \* Never disclose the tokens externally (e.g. in your front-end). ### Renewal `login_identity_token` expires after 1 hour. `login_identity_refresh_token` expires after 90 days. Implement `POST /auth/token/refresh` for token renewal. operationId: token requestBody: content: application/x-www-form-urlencoded: schema: type: object properties: grant_type: type: string enum: - authorization_code description: 'Accepted values: `authorization_code`' code: type: string description: >- Use `code` URL parameter returned to Customer App's redirect URI client_id: type: string description: >- See API credentials. Managed on Finverse developer dashboard ([dashboard.finverse.com](https://desktop.postman.com/?desktopVersion=9.31.0&userId=11503733&teamId=1064586)) redirect_uri: type: string description: >- Must match the `redirect_uri` associated with the Customer App. Managed on Finverse developer dashboard ([dashboard.finverse.com](https://desktop.postman.com/?desktopVersion=9.31.0&userId=11503733&teamId=1064586)) required: - grant_type - code - client_id - redirect_uri required: true responses: '200': description: Service Okay content: application/json: schema: $ref: '#/components/schemas/AccessTokenResponse' examples: success: summary: Success value: access_token: '{login_identity_token}' expires_in: 3600 issued_at: '2022-08-01T01:01:00.000Z' login_identity_id: login_identity_id refresh_token: '{login_identity_refresh_token}' token_type: Bearer '400': description: Invalid Request content: application/json: schema: $ref: '#/components/schemas/BadRequestModelV2' examples: invalid_or_expired_code: summary: Error (invalid or expired code) value: error: code: 40001 details: Invalid code. error_code: INVALID_GRANT message: >- One or more authorization parameters is invalid, expired or revoked. Please review parameter inputs. request_id: '{unique_id}' type: API_ERROR '500': description: Internal Server Error content: application/json: schema: $ref: '#/components/schemas/BadRequestModelV2' security: - Oauth2: - loginIdentity:token components: schemas: AccessTokenResponse: required: - access_token - login_identity_id - token_type - expires_in - refresh_token - issued_at properties: access_token: type: string description: >- **(SENSITIVE)** Login Identity access token (referred to as `login_identity_token`). expires_in: description: Access token validity length (in seconds). type: integer format: int64 issued_at: type: string format: date-time description: Access token issue time login_identity_id: type: string description: >- Finverse Login Identity ID for this Login Identity. Always unique. Linking the same account at the same institution twice will result in two Login Identities with different IDs (use Refresh/Relink methods to refresh data for a Login Identity without updating the ID). refresh_token: type: string description: >- **(SENSITIVE)** Login Identity refresh token (referred to as `login_identityrefresh_token`) token_type: type: string description: 'Possible values: `Bearer`' BadRequestModelV2: properties: error: type: object required: - type - code - error_code - message - request_id properties: code: type: integer example: 40004 details: type: string error_code: type: string example: CREDENTIALS_INVALID message: type: string request_id: description: The request_id provided in the request header type: string type: description: The error type type: string enum: - LINK_ERROR - API_ERROR example: LINKING_ERROR securitySchemes: Oauth2: type: oauth2 flows: clientCredentials: tokenUrl: https://finverse-dev.us.auth0.com/oauth/token scopes: account: Account balance: Balance credit: Credit institution: Institution investment: Investment link: Link test: Test transaction: Transaction ````