> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bvndle.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get SSO Access Token (V2)

> Call this endpoint to exchange an authorization code and PKCE verifier for an SSO access token

###

Note

:

Step 2 of 2: send the authorization code and the original codeVerifier from Create Authorization Code (V2). Verify the returned JWT signature using your client secret and HS256 before trusting the user details.

####

###

Start with [Create Authorization Code (V2)](https://docs.bvndle.com/bvndle-sso/create-authorization-code-v2.md). Send both fields in the JSON request body.

###

Request Body

name
type
Description

###

```bash cURL theme={null}
curl --request POST \
'https://test-api.bvndle.com/api/v2/ufel/users/authorization/sso-access-token' \
--header 'Content-Type: application/json' \
--data-raw '{
  "authorizationCode": "GDTC1ZHSNSEO95QDXMCT",
  "codeVerifier": "RdxTqU8BXVqs4gOdXDjbCAPv8wrJ0iTtN0qFPWKLwANmiiPC5mfFrdcA2x6WdDloU0PKj0E3a8mMuNnAaxBL5vACAVIEmo5UPEib"
}'
```

###

```json Success theme={null}
{
  "status": "success",
  "message": "Access token fetched successfully",
  "data": {
    "ssoAccessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
  }
}
```

```json Error 404 theme={null}
{
  "status": "failed",
  "message": "data not found",
  "data": {
    "errorType": "not found",
    "appErrorCode": "",
    "error": "Invalid Authorization Code"
  }
}
```

###

The success example abbreviates the JWT. `data.ssoAccessToken` contains the signed user profile and KYC information. Its `iat` is the time Step 1 succeeded; `exp` is `iat + 900` seconds.

Errors

name
type
Description

###

Expiry

:

The token expires 15 minutes after the authorization code was issued in Step 1, not 15 minutes after this exchange. Exchange immediately. After the token expires, start again from Create Authorization Code (V2).

###

Single Use

:

A successful exchange clears the authorization code and its challenge. Reusing it returns 404 Invalid Authorization Code. If two exchanges use the same code concurrently, only one succeeds.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.