# exchangeCodeForToken

**Kind:** Function

**Source:** [`atloria-monorepo/packages/ui-core/src/components/api-explorer/oauth2.ts`](https://github.com/sherkety/atloria/blob/main/atloria-monorepo/packages/ui-core/src/components/api-explorer/oauth2.ts#L587)

Exchange the authorization code for a token, directly from the browser.

No `client_secret` is sent — this is a public client, and PKCE's verifier is what proves the
exchange belongs to the request that started it.

## Signature

```ts
async function exchangeCodeForToken(exchange: TokenExchange): Promise<OAuth2Grant>
```

## Parameters

| Name | Type |
|---|---|
| `exchange` | `TokenExchange` |

**Returns:** `Promise<OAuth2Grant>`