Exchange an authorization code for an access token
RFC 6749 authorization-code exchange with required S256 PKCE verification. It authenticates the request with the code, registered client, redirect URI, and verifier rather than a bearer token or client secret. Send either JSON or application/x-www-form-urlencoded with the same fields.
Body
authorization_code Short-lived, single-use authorization code.
Must exactly match the URI used in the authorization request.
RFC 7636 S256 PKCE verifier.
43 - 128Optional RFC 8707 resource indicator. If presented, it must match the authorization request.
Response
A scoped bearer access token. Cloner exchanges also include the connected account and site.
Scoped bearer token. Store it securely; the response has no refresh token.
Bearer Space-separated granted scopes.
Present for SandyWP Cloner exchanges.
Present for SandyWP Cloner exchanges.

