> For the complete documentation index, see [llms.txt](https://docs.maneslab.xyz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.maneslab.xyz/zh/api-zheng-he/quick-start/2.-redirect-back-to-your-site-by-mid.md).

# 2. Redirect back to your site by MID

If the user accepts your request, MID redirects the user back to your site with a temporary **`code`** in a code parameter. The temporary code will expire after 10 minutes. 

In addition, it also contains the state you provided in the previous step in the **`state`** parameter. If the states don't match, it means a third party created the request, and you should abort the process.

Exchange the code for an access token:

```HTTP
POST https://mid.maneslab.xyz/api/v1/oauth/token
```

#### Parameters:

<table><thead><tr><th width="210.33333333333331">Parameter name</th><th width="182">Type</th><th>Description</th></tr></thead><tbody><tr><td>client_id</td><td>string</td><td>Required. The client ID you received from MID for your OAuth App.</td></tr><tr><td>client_secret</td><td>string</td><td>Required. The client secret you received from MID for your OAuth App.</td></tr><tr><td>grant_type</td><td>string</td><td>Required. grant_type=authorization_code</td></tr><tr><td>code</td><td>string</td><td>Required. The code you received as a response to Step 1.</td></tr><tr><td>redirect_uri</td><td>string</td><td>Required. The URL in your application where users are sent after authorization.</td></tr></tbody></table>

sample code:

```
let data = {
    'client_id': client_id,
    'client_secret': client_secret,
    'grant_type': 'authorization_code',
    'code': code,
    'redirect_uri': redirect_uri,
};

let form_body = [];
for (let property in data) {
    let encoded_key = encodeURIComponent(property);
    let encoded_value = encodeURIComponent(data[property]);
    form_body.push(encoded_key + "=" + encoded_value);
}
form_body = form_body.join("&");

let options = {
    method: 'POST',
    headers: {
        "content-type": "application/x-www-form-urlencoded",
    },
    body: form_body
};

fetch(`https://mid.maneslab.xyz/api/v1/oauth/token`, options)
    .then(response => response.json())
    .then(response => {
        console.log(response)
    })
    .catch(err => console.error(err));
```

Example responses:

```JSON
{
  "access_token":"xxxxxxxx",
  "token_type":"bearer"
}
```