---
title: Authorization code
slug: web-experimentation/docs/authorization-code
docTags: 
createdAt: 2026-07-23T11:40:26.754Z
---

After you obtain an authorization code, you can exchange this authorization code for an access token by issuing an HTTPS POST request to Optimizely's authorization server.

The following examples show an example request and a successful response. The response includes an access token (with a lifetime of two hours) as well as a *refresh token* that can be used to request more access tokens after the initial access token expires.

## Definitions

- **code** – The authorization code returned in the redirect.
- **client\_id** – The client ID for your application (see [app settings](https://app.optimizely.com/v2/accountsettings/registered-apps)).
- **client\_secret** – The client secret for your application (see [app settings](https://app.optimizely.com/v2/accountsettings/registered-apps)).
- **redirect\_uri** – The redirect URI used when requesting the authorization code.
- **grant\_type** – Defined in the OAuth 2.0 spec, this field must contain a value of `authorization_code`.

## Example POST request

```http
POST https://app.optimizely.com/oauth2/token
  ?code=asdbawejksd
  &client_id=123
  &client_secret=iamverysecret
  &redirect_uri=http%3A%2F%2Fmyapplication.com
  &grant_type=authorization_code
```

## Example JSON response

```json
{
  "access_token": "abcdefghijklmnopqrstuvwxyz",
  "expires_in": 7200,
  "token_type": "bearer",
  "refresh_token": "1234567890abcdefghijklmnopqrstuvwxyz"
}
```