Reference token leg — code → access token (sandbox)

Sandbox only. Hosted on the census host root (not /api/v1), gated on PHOSRA_ENV==sandbox — 404 elsewhere.

Exchanges an authorization code (any value carrying the sbxauth_ prefix, from GET /oauth/authorize) for an opaque bearer access token. Accepts application/x-www-form-urlencoded or JSON. A PKCE code_verifier is accepted and ignored. Stateless — tokens live one hour.

Worked example

This leg is unsigned; supply the one-time code returned by the authorize leg:

bash
curl -X POST https://phosra-api-sandbox-production.up.railway.app/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code&code=$SANDBOX_AUTHORIZATION_CODE"

Example 200 response (bearer token redacted):

json

{
  "access_token": "REDACTED_SANDBOX_ACCESS_TOKEN",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "profiles"
}

An unsupported grant_type returns 400 unsupported_grant_type; a code without the sbxauth_ prefix returns 400 invalid_grant. Present the sbxtok_… token to GET /oauth/profiles.