# Is the code provided in /callback a one time use code?

**URL:** <https://community.hubspot.com/t/is-the-code-provided-in-callback-a-one-time-use-code/118946>\
**Category:** APIs & Integrations\
**Tags:** starter\
**Created:** [October 22, 2024, 7:24pm UTC](https://community.hubspot.com/t/is-the-code-provided-in-callback-a-one-time-use-code/118946 "2024-10-22T19:24:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![JTang79](https://avatars.discourse-cdn.com/v4/letter/j/839c29/32.png) [@JTang79](https://community.hubspot.com/u/JTang79)\
**Post date:** [October 22, 2024, 7:24pm UTC](https://community.hubspot.com/t/is-the-code-provided-in-callback-a-one-time-use-code/118946/1 "2024-10-22T19:24:48Z")

</div>

Hello, I’m currently working on a mini project that uses OAuth Callback Url. The following is part of the documentation that I was given regarding it. I was working on a generate file to generate the “state” and “code” variable based on this [Working with OAuth | OAuth Quickstart Guide](https://developers.hubspot.com/docs/api/oauth-quickstart-guide) documentation. However when managed to authenticate my hubspot app and navigate to the redirect\_uri. The code listed in the url (i.e. [http://localhost:6969?code=xxx-xxx-xxx](http://localhost:6969?code=xxx-xxx-xxx)) doesn’t work when i try it in postman. My question is, is the code xxx-xxx-xxx just a one time thing? If not how would I be able to reuse that?

## OAuth Callback URL

The OAuth Callback URL is used to handle the OAuth callback from the HubSpot CRM system.

GET /hubspot/connect/oauth/callback?state={state}&code={code}

- Request

- Response: Redirect to the frontend callback page.

---

<div class="post-metadata">

**Author:** ![Jaycee\_Lewis](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/jaycee_lewis/32/61352_2.png) [@Jaycee\_Lewis](https://community.hubspot.com/u/Jaycee_Lewis)\
**Post date:** [October 22, 2024, 10:05pm UTC](https://community.hubspot.com/t/is-the-code-provided-in-callback-a-one-time-use-code/118946/2 "2024-10-22T22:05:05Z")

</div>

Hey, @JTang79 👋 Welcome to our community!

Yes, the code in the /callback URL is a one-time-use authorization code. After you get this code, you need to exchange it for an access token by making a POST request to the OAuth token endpoint:

`POST https://api.hubapi.com/oauth/v1/token`

Use the code from the URL in this request. Afterward, you get an access token (for API requests) and a refresh token (to renew the access token).

The authorization code can’t be reused, and it expires quickly, so you’ll need to get a new one if it’s already used.

Have fun building! — Jaycee