From your server, exchange the one-time code from Step 2 for an access token and a refresh token that act as the signed-in user. The access token lasts 24 hours and the refresh token 30 days. Use the same endpoint later with grant_type=refresh_token to get a new access token without asking the user to sign in again. This path is at the server root, not under /api/v1.

Prerequisites: the code from Step 2, used within 10 minutes; your client_id and client_secret from the dashboard's API Keys page (keep the secret on your server); and the same redirect_uri you sent in Step 1.

Authentication: Public (no token). Your app authenticates with client_id and client_secret in the request body; a wrong or unknown client returns 401 invalid_client.

Requests to all rate-limited endpoints count toward the same per-IP total.

Rate limit: 60 requests per minute, counted per client IP address.