# How can I exchange a sessionToken for an AccessToken in the backend for an application/client with PKCE **URL:** \ **Category:** Questions\ **Created:** [June 29, 2020, 8:38pm UTC](https://devforum.okta.com/t/how-can-i-exchange-a-sessiontoken-for-an-accesstoken-in-the-backend-for-an-application-client-with-pkce/9979 "2020-06-29T20:38:53Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![roopG](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@roopG](https://devforum.okta.com/u/roopG)\ **Post date:** [June 29, 2020, 8:38pm UTC](https://devforum.okta.com/t/how-can-i-exchange-a-sessiontoken-for-an-accesstoken-in-the-backend-for-an-application-client-with-pkce/9979/1 "2020-06-29T20:38:53Z")
**Application/Client Grant Type: Authorization\_Code with PKCE** I am building an Integration Test Suite, where I need to obtain the access\_token using only **api calls(backend)**. I am able to use the [Proprietary OKTA Authentication API](https://developer.okta.com/docs/reference/api/authn/) `https://dev-215257.okta.com/api/v1/authn` and subsequently the MFA verify api `https://dev-215257.okta.com/api/v1/authn/factors/{{factorId}}/verify` to obtain the **sessionToken**. Next I am trying to exchange the **sessionToken** for **AccessToken** as per the doc [https://developer.okta.com/docs/reference/api/oidc/#authorize](https://developer.okta.com/docs/reference/api/oidc/#authorize) `'https://dev-215257.okta.com/oauth2/default/v1/authorize?client_id=0oa3gtvqedqiKMp8k357&response_type=id_token%20token&scope=openid%20profile%20email&redirect_uri=http://localhost:8080/authorization-code/callback&state=testing&nonce=testing%20nonce&sessionToken=20111zbLpLymutMOp2T0OPohIyEuIw_ODj78qYRkGNGKLPDhE7Y6_xH` **I am getting the response: Error: connect ECONNREFUSED 127.0.0.1:8080. (this is the callback url)** I am **expecting** an **IDToken** and **AccessToken** in the response. Any help is appreciated. ---
**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\ **Post date:** [June 30, 2020, 3:08am UTC](https://devforum.okta.com/t/how-can-i-exchange-a-sessiontoken-for-an-accesstoken-in-the-backend-for-an-application-client-with-pkce/9979/2 "2020-06-30T03:08:12Z")
What is the URL you are redirected to, it should include `id_token` requested as a part of URL ---
**Author:** ![roopG](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@roopG](https://devforum.okta.com/u/roopG)\ **Post date:** [June 30, 2020, 3:14am UTC](https://devforum.okta.com/t/how-can-i-exchange-a-sessiontoken-for-an-accesstoken-in-the-backend-for-an-application-client-with-pkce/9979/3 "2020-06-30T03:14:52Z")
the redirect URL has the error Response: `http://localhost:8080/authorization-code/callback#state=testing&error=unsupported_response_type&error_description=The+response+type+is+not+supported+by+the+authorization+server.+Configured+response+types%3A+%5Bcode%5D` I believe as the grant\_type configured is **authorization\_code** , I have to use response\_type=code… And when I do that, then I get the following redirect URL: [https://dev-215257.okta.com/login/login.htm?fromURI=%2Foauth2%2Fv1%2Fauthorize%2Fredirect%3Fokta\_key%3D3fmgcE5TCPgQJJ-AF7gDCeWtVIeXSZZ1wYXtJRi6dh8](https://dev-215257.okta.com/login/login.htm?fromURI=%2Foauth2%2Fv1%2Fauthorize%2Fredirect%3Fokta_key%3D3fmgcE5TCPgQJJ-AF7gDCeWtVIeXSZZ1wYXtJRi6dh8) ---
**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\ **Post date:** [June 30, 2020, 3:28am UTC](https://devforum.okta.com/t/how-can-i-exchange-a-sessiontoken-for-an-accesstoken-in-the-backend-for-an-application-client-with-pkce/9979/4 "2020-06-30T03:28:47Z")
Check this one [https://developer.okta.com/docs/guides/session-cookie/overview/#retrieving-a-session-cookie-via-openid-connect-authorization-endpoint](https://developer.okta.com/docs/guides/session-cookie/overview/#retrieving-a-session-cookie-via-openid-connect-authorization-endpoint) try to provide `prompt=none` param while sending the initial request to `/authorize` ---
**Author:** ![roopG](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@roopG](https://devforum.okta.com/u/roopG)\ **Post date:** [June 30, 2020, 3:33am UTC](https://devforum.okta.com/t/how-can-i-exchange-a-sessiontoken-for-an-accesstoken-in-the-backend-for-an-application-client-with-pkce/9979/5 "2020-06-30T03:33:19Z")
I tried that as well… here is what I get inspite of a **valid** **sessionToken** following successful authentication **seconds** ago… [http://localhost:8080/authorization-code/callback?state=testing&error=login\_required&error\_description=The+client+specified+not+to+prompt%2C+but+the+client+app+requires+re-authentication+or+MFA](http://localhost:8080/authorization-code/callback?state=testing&error=login_required&error_description=The+client+specified+not+to+prompt%2C+but+the+client+app+requires+re-authentication+or+MFA) ![image](https://global.discourse-cdn.com/oktadev/original/2X/8/8a674b158ea53d198b455ca3daad0cfa94dcf1b0.png) ---
**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\ **Post date:** [June 30, 2020, 3:50am UTC](https://devforum.okta.com/t/how-can-i-exchange-a-sessiontoken-for-an-accesstoken-in-the-backend-for-an-application-client-with-pkce/9979/6 "2020-06-30T03:50:08Z")
are you sure the sign-on policy for this application doesn’t require re-authentication? ---
**Author:** ![roopG](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@roopG](https://devforum.okta.com/u/roopG)\ **Post date:** [June 30, 2020, 4:00am UTC](https://devforum.okta.com/t/how-can-i-exchange-a-sessiontoken-for-an-accesstoken-in-the-backend-for-an-application-client-with-pkce/9979/7 "2020-06-30T04:00:01Z")
@phi1ipp yes you are correct it was configured **Every Sign On** , I changed it to **Once per Session.** …still getting the same issue…does it take time to change…Thanks much… ![image](https://global.discourse-cdn.com/oktadev/original/2X/9/9221a06866911b17cec0507597317d7eb62137ae.png) ---
**Author:** ![phi1ipp](https://avatars.discourse-cdn.com/v4/letter/p/85f322/32.png) [@phi1ipp](https://devforum.okta.com/u/phi1ipp)\ **Post date:** [June 30, 2020, 4:13am UTC](https://devforum.okta.com/t/how-can-i-exchange-a-sessiontoken-for-an-accesstoken-in-the-backend-for-an-application-client-with-pkce/9979/8 "2020-06-30T04:13:08Z")
I suggest you to remove the application sign-on policy and keep it as default one, which just allows access to the application. Test if it works this way. You can always introduce MFA for the initial sign-on which you handle with auth-js ---
**Author:** ![roopG](https://avatars.discourse-cdn.com/v4/letter/r/9e8a1a/32.png) [@roopG](https://devforum.okta.com/u/roopG)\ **Post date:** [June 30, 2020, 4:35am UTC](https://devforum.okta.com/t/how-can-i-exchange-a-sessiontoken-for-an-accesstoken-in-the-backend-for-an-application-client-with-pkce/9979/9 "2020-06-30T04:35:17Z")
@phi1ipp. thanks I removed the application sign-on policy falling back to the default policy. Now I get the **code** in the redirect **location** header. Thanks Much. Since My OKTA Org policy is configured for MFA enforced once per session. I am getting prompted for the MFA when I hit the `{{url}}/api/v1/authn` but I am able to call the TOTP verify endpoint to get passed the MFA and obtain the SessionToken prior to making the /authorize call. In conclusion, Removing the custom sign-on policy for the application did the trick. Mucho Gracias @phi1ipp ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [January 24, 2024, 11:35pm UTC](https://devforum.okta.com/t/how-can-i-exchange-a-sessiontoken-for-an-accesstoken-in-the-backend-for-an-application-client-with-pkce/9979/10 "2024-01-24T23:35:32Z")
This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.