---
title: "Issue a new access token"
method: POST
path: "/api/v1/oauth2/token"
tags: ["Auth"]
---

# Issue a new access token

`POST /api/v1/oauth2/token`

Issue a new access token

## Request body

- union — Request token with given grant type - client_credentials, magic_code, google_id_token, or refresh_token
  - object
    - `grant_type` 'client_credentials', required
    - `client_id` string, uuid, required — The client ID of the partner or merchant
    - `client_secret` string, required — The client secret of the partner or merchant
  - object
    - `grant_type` 'magic_code', required
    - `email` string, email, required — Admin email address
    - `code` string — The 6-character verification code sent to email
    - `ctx` string — Optional context: "global", "partner:uuid", or "merchant:uuid"
  - object
    - `grant_type` 'google_id_token', required
    - `id_token` string, required — Google ID token obtained from Google Sign-In
    - `ctx` string — Optional context: "global", "partner:uuid", or "merchant:uuid"
  - object
    - `grant_type` 'refresh_token', required
    - `refresh_token` string, required — The refresh token obtained from a previous token request
    - `ctx` string — Optional context to switch to: "global", "partner:uuid", or "merchant:uuid".

## Response `200`

Success

- AuthTokenResponse
  - `success` boolean, required — Indicates if the request was successful
  - `data` object, required
    - `access_token` string, required — The access token to be used for authenticated requests
    - `refresh_token` string — The refresh token used to obtain a new access token. Returned only when a token is first issued (client_credentials, magic_code, google_id_token grants); the refresh grant does not return a new refresh token, so the original is reused until it expires.
    - `token_type` 'Bearer', required — The type of token issued
    - `expires_in` number, required — The number of seconds until the access token expires

## Other responses

- `400` — Bad Request
- `401` — Unauthorized

---

[API](https://skmtc.net/banqzinc/apis/quidkey-api.md) · [All operations](https://skmtc.net/banqzinc/apis/quidkey-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/banqzinc/quidkey-api/revisions/f86d2bdbcb08/schema)