> ## Documentation Index
> Fetch the complete documentation index at: https://developers.paperlink.online/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange code or refresh token for tokens



## OpenAPI

````yaml https://app.paperlink.online/api/mobile/openapi.json post /api/auth/mobile/token
openapi: 3.1.0
info:
  title: PaperLink Mobile API
  version: 1.0.0
  description: >-
    Device-session API for the PaperLink mobile app. Tokens are per-user (no
    team baked in); the acting team is sent per request via X-Team-Id and the
    role is resolved live.
  contact:
    name: PaperLink Support
    url: https://paperlink.online
servers:
  - url: https://app.paperlink.online
    description: Production
security:
  - BearerAuth: []
paths:
  /api/auth/mobile/token:
    post:
      tags:
        - Auth
      summary: Exchange code or refresh token for tokens
      operationId: mobileToken
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TokenRequest'
      responses:
        '200':
          description: Tokens
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '429':
          $ref: '#/components/responses/RateLimited'
      security: []
components:
  schemas:
    TokenRequest:
      oneOf:
        - type: object
          required:
            - grant_type
            - code
            - code_verifier
            - redirect_uri
            - client_id
          properties:
            grant_type:
              type: string
              enum:
                - authorization_code
            code:
              type: string
            code_verifier:
              type: string
            redirect_uri:
              type: string
              format: uri
            client_id:
              type: string
            install_id:
              type: string
            user_agent:
              type: string
        - type: object
          required:
            - grant_type
            - refresh_token
          properties:
            grant_type:
              type: string
              enum:
                - refresh_token
            refresh_token:
              type: string
    TokenResponse:
      type: object
      properties:
        access_token:
          type: string
        refresh_token:
          type: string
        token_type:
          type: string
        expires_in:
          type: integer
        user_id:
          type: string
  responses:
    BadRequest:
      description: Invalid request
    Unauthorized:
      description: Missing, expired, or revoked token
    RateLimited:
      description: Rate limit exceeded
      headers:
        Retry-After:
          schema:
            type: integer
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer

````