# SPA Application get access token with code and PKCE got 403 response

**URL:** <https://devforum.okta.com/t/spa-application-get-access-token-with-code-and-pkce-got-403-response/9458>\
**Category:** Questions\
**Created:** [May 21, 2020, 7:25am UTC](https://devforum.okta.com/t/spa-application-get-access-token-with-code-and-pkce-got-403-response/9458 "2020-05-21T07:25:09Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![vijet](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/vijet/32/245_2.png) [@vijet](https://devforum.okta.com/u/vijet)\
**Post date:** [May 21, 2020, 4:52pm UTC](https://devforum.okta.com/t/spa-application-get-access-token-with-code-and-pkce-got-403-response/9458/3 "2020-05-21T16:52:20Z")

</div>

Quoting @andrea from a previous question

> [@Getting a 403 when attempting to exchange an authorization code for an access token](https://devforum.okta.com/t/getting-a-403-when-attempting-to-exchange-an-authorization-code-for-an-access-token/1151/21):
>
> In case anyone else is encountering this issue, the /token endpoint is returning a 403 because a CSRF check is failing. When a cookie is present in your request, Okta will assume it is coming from a browser and perform a CSRF check. In order to resolve this, ensure you are NOT including the ‘sid’ cookie with your request to /token. If you encounter this issue in Postman, you can resolve it by clearing your cookies there.

Please clear your cookies and try again. It should work.

---

_[View the full topic](https://devforum.okta.com/t/spa-application-get-access-token-with-code-and-pkce-got-403-response/9458)._