Is the code provided in /callback a one time use code?

Develop, Build & Integrate APIs & Integrations
1

Hello, I’m currently working on a mini project that uses OAuth Callback Url. The following is part of the documentation that I was given regarding it. I was working on a generate file to generate the “state” and “code” variable based on this Working with OAuth | OAuth Quickstart Guide documentation. However when managed to authenticate my hubspot app and navigate to the redirect_uri. The code listed in the url (i.e. http://localhost:6969?code=xxx-xxx-xxx) doesn’t work when i try it in postman. My question is, is the code xxx-xxx-xxx just a one time thing? If not how would I be able to reuse that?

OAuth Callback URL

The OAuth Callback URL is used to handle the OAuth callback from the HubSpot CRM system.

GET /hubspot/connect/oauth/callback?state={state}&code={code}

  • Request

    • state: The state value passed in the OAuth Authorization request.
    • code: The authorization code returned by the HubSpot CRM system.

  • Response: Redirect to the frontend callback page.

2

Hey, @JTang79 :waving_hand: Welcome to our community!

Yes, the code in the /callback URL is a one-time-use authorization code. After you get this code, you need to exchange it for an access token by making a POST request to the OAuth token endpoint:

POST https://api.hubapi.com/oauth/v1/token

Use the code from the URL in this request. Afterward, you get an access token (for API requests) and a refresh token (to renew the access token).

The authorization code can’t be reused, and it expires quickly, so you’ll need to get a new one if it’s already used.

Have fun building! — Jaycee