> ## Documentation Index
> Fetch the complete documentation index at: https://docs-staging.auth0-mintlify.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Token Exchange for Native Social

> Exchange a native social token (such as Apple or Google) for Auth0 tokens using the token exchange grant.

## Endpoint

`POST /oauth/token`

> [!NOTE]
>
> This flow is intended for use with native social interactions **only**. Use of this flow outside of a native social setting is highly discouraged.

When a non-browser-based solution (such as a mobile platform's SDK) authenticates the user, the authentication will commonly result in artifacts being returned to application code. In such situations, this grant type allows for the Auth0 platform to accept artifacts from trusted sources and issue tokens in response. In this way, apps making use of non-browser-based authentication mechanisms (as are common in native apps) can still retrieve Auth0 tokens without asking for further user interaction.

Artifacts returned by this flow (and the contents thereof) will be determined by the `subject_token_type` and the tenant's configuration settings.

## Remarks

* The scopes issued to the application may differ from the requested scopes. In this case, a `scope` parameter will be included in the response JSON.
* If you don't request specific scopes, all scopes defined for the audience will be returned due to the implied trust to the application in this grant. You can customize the scopes returned in a rule. To learn more, read [Calling APIs from Highly Trusted Applications](https://auth0.com/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow).

## Learn More

* [Add Sign In with Apple to Native iOS Apps](https://auth0.com/docs/authenticate/identity-providers/social-identity-providers/apple-native)
* [iOS Swift - Sign In with Apple Quickstart](https://auth0.com/docs/quickstart/native/ios-swift)

## Headers

**DPoP** `string`

A DPoP proof for the request. This is optional and only required if your application uses Demonstrating Proof-of-Possession.

## Body Parameters

The request body is in `application/x-www-form-urlencoded` format.

**auth0-forwarded-for** `string`

End user IP as a string value. Set this if you want brute-force protection to work in server-side scenarios. To learn more about how and when to use this header, read [Using resource owner password from server-side](https://docs-staging.auth0-mintlify.app/api-auth/tutorials/using-resource-owner-password-from-server-side).

**grant\_type** `string` *required*

Denotes the flow you are using. For Token Exchange for Native Social, use `urn:ietf:params:oauth:grant-type:token-exchange`.

**subject\_token** `string` *required*

Externally-issued identity artifact representing the user.

**subject\_token\_type** `string` *required*

Identifier that indicates the type of `subject_token`.

**client\_id** `string` *required*

Your application's Client ID.

**audience** `string`

The unique identifier of the target API you want to access.

**resource** `string`

The identifier of the target API (resource server) you want to access. Must match an API Identifier registered in your Auth0 tenant. Used as an alternative to `audience` when the tenant's [Resource Parameter Compatibility Profile](https://auth0.com/docs/get-started/tenant-settings#settings-advanced) is set to `compatibility`.

**scope** `string`

String value of the different scopes the application is requesting. Multiple scopes are separated with whitespace.

**user\_profile** `object`

Optional element used for native iOS interactions for which profile updates can occur. Expected parameter value will be JSON in the form of: `{ name: { firstName: 'John', lastName: 'Smith' }}`.

**properties**

**name** `object`

## Response Schema

200

\{}

application/json

**access\_token** `string`

The issued access token.

**id\_token** `string`

The issued ID token.

**refresh\_token** `string`

The issued refresh token.

**token\_type** `string`

The type of token issued.

**expires\_in** `integer`

The access token lifetime in seconds.

default

\{}

application/json

**error** `string`

Error code.

**error\_description** `string`

Error description.

## Response Messages

| Status | Description |
| - | - |
| 200 | Successful response |
| default | Unexpected error |