---
title: "POST /v1/token"
method: POST
path: "/v1/token"
---

# POST /v1/token

`POST /v1/token`

CreateOAuth2Token API

Path: /v1/token Request Method: POST Content-Type: application/json or application/x-www-form-urlencoded

This API implements OAuth 2.0 flows for AWS Sign-In CLI clients, supporting both:

1.  Authorization code redemption (grant\_type=authorization\_code) - NOT idempotent
2.  Token refresh (grant\_type=refresh\_token) - Idempotent within token validity window

The operation behavior is determined by the grant\_type parameter in the request body:

**Authorization Code Flow (NOT Idempotent):**

*   JSON or form-encoded body with client\_id, grant\_type=authorization\_code, code, redirect\_uri, code\_verifier
*   Returns access\_token, token\_type, expires\_in, refresh\_token, and id\_token
*   Each authorization code can only be used ONCE for security (prevents replay attacks)

**Token Refresh Flow (Idempotent):**

*   JSON or form-encoded body with client\_id, grant\_type=refresh\_token, refresh\_token
*   Returns access\_token, token\_type, expires\_in, and refresh\_token (no id\_token)
*   Multiple calls with same refresh\_token return consistent results within validity window

Authentication and authorization:

*   Confidential clients: sigv4 signing required with signin:ExchangeToken permissions
*   CLI clients (public): authn/authz skipped based on client\_id & grant\_type

Note: This operation cannot be marked as @idempotent because it handles both idempotent (token refresh) and non-idempotent (auth code redemption) flows in a single endpoint.

## Request body

- object
  - `tokenInput` object, required — <p>Request body payload for CreateOAuth2Token operation</p> <p>The operation type is determined by the grant_type parameter:</p> <ul> <li>grant_type=authorization_code: Requires code, redirect_uri, code_verifier</li> <li>grant_type=refresh_token: Requires refresh_token</li> </ul>
    - `clientId` string — The client identifier (ARN) used during Sign-In onboarding Required for both authorization code and refresh token flows
    - `grantType` string — OAuth 2.0 grant type - determines which flow is used Must be &quot;authorization_code&quot; or &quot;refresh_token&quot;
    - `code` string — The authorization code received from /v1/authorize Required only when grant_type=authorization_code
    - `redirectUri` string — The redirect URI that must match the original authorization request Required only when grant_type=authorization_code
    - `codeVerifier` string — PKCE code verifier to prove possession of the original code challenge Required only when grant_type=authorization_code
    - `refreshToken` string, password — The refresh token returned from auth_code redemption Required only when grant_type=refresh_token

## Response `200`

Success

- CreateOAuth2TokenResponse — <p>Output structure for CreateOAuth2Token operation</p> <p>Contains flattened token operation outputs for both authorization code and refresh token flows. The response content depends on the grant_type from the original request.</p>
  - `tokenOutput` object, required — Flattened token operation outputs The specific response fields depend on the grant_type used in the request
    - `accessToken` object, required — Scoped-down AWS credentials (15 minute duration) Present for both authorization code redemption and token refresh
      - `accessKeyId` string, required — AWS access key ID for temporary credentials
      - `secretAccessKey` string, required — AWS secret access key for temporary credentials
      - `sessionToken` string, required — AWS session token for temporary credentials
    - `tokenType` string, required — Token type indicating this is AWS SigV4 credentials Value is &quot;aws_sigv4&quot; for both flows
    - `expiresIn` integer, required — Time to expiry in seconds (maximum 900) Present for both authorization code redemption and token refresh
    - `refreshToken` string, password, required — Encrypted refresh token with cnf.jkt (SHA-256 thumbprint of presented jwk) Always present in responses (required for both flows)
    - `idToken` string — ID token containing user identity information Present only in authorization code redemption response (grant_type=authorization_code) Not included in token refresh responses

## Other responses

- `480` — TooManyRequestsError
- `481` — InternalServerException
- `482` — ValidationException
- `483` — AccessDeniedException

---

[API](https://skmtc.net/aws/apis/signin.md) · [All operations](https://skmtc.net/aws/apis/signin/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/signin/versions/589622887ba7/schema)