---
title: "Trocar código por token — BeeFood API"
description: "POST /v1/oauth/token com grant_type authorization_code e PKCE para Conectar com BeeFood."
url: "https://developer.beefood.com.br/docs/oauth/trocar-codigo"
group: "OAuth"
lang: "pt"
---
# Trocar código por token

`POST /v1/oauth/token`

- Produção: `https://api.beefood.app/v1/oauth/token`
- Sandbox: `https://api-sandbox.beefood.app/v1/oauth/token`

Troca o código de autorização por tokens no fluxo Conectar com BeeFood.

Envie JSON ou application/x-www-form-urlencoded do servidor após validar state. Não usa client_secret.

| Body | Required | Description |
| --- | --- | --- |
| grant_type | yes | authorization_code |
| client_id | yes | Integrator identifier |
| code | yes | Callback code, valid 10 minutes and one use |
| redirect_uri | yes | Exact same URI sent during authorization |
| code_verifier | yes | Original PKCE verifier from the session |

```bash
curl -X POST 'https://api.beefood.app/v1/oauth/token' -H 'Content-Type: application/json' -d '{"grant_type":"authorization_code","client_id":"Repediu","code":"bf_ac_4af8c92e1b6742d7a0539ec8640f2b1d","redirect_uri":"https://app.integradora.com/beefood/callback","code_verifier":"R7qY4uW9pL2mC8xB5nK3dF6sA0hT1jV4eZ7gQ2rM9wP5yN8bD3cH6kS0fU1aX4zJ"}'
```

## Resposta 200

```json
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2FwaS5iZWVmb29kLmFwcCIsInN1YiI6InN0b3JlXzhhMTJkNmVmIiwiYXVkIjoiYmVlZm9vZC1hcGkiLCJzY29wZSI6Im9yZGVyczpyZWFkIG1lbnU6cmVhZCIsImp0aSI6ImI5ZjRjMTBlIiwiaWF0IjoxNzkwOTM1MjAwLCJleHAiOjE3OTA5Mzg4MDB9.c2ltdWxhZG8tYXBlbmFzLWV4ZW1wbG8",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2FwaS5iZWVmb29kLmFwcCIsInN1YiI6InN0b3JlXzhhMTJkNmVmIiwiYXVkIjoiYmVlZm9vZC1hcGkiLCJzY29wZSI6Im9mZmxpbmVfYWNjZXNzIiwianRpIjoiY2Q3MWE4NDAiLCJpYXQiOjE3OTA5MzUyMDAsImV4cCI6MTc5MzUyNzIwMH0.c2ltdWxhZG8tYXBlbmFzLWV4ZW1wbG8"
}
```

GET /v1/store/merchants com Authorization: Bearer <access_token> identifica os restaurantes autorizados. Erros seguem {message, status}: 400 para parâmetros inválidos; 401 para code expirado, reutilizado ou PKCE incorreto.