---
title: "Request access token"
method: POST
path: "/oauth2/token"
tags: ["Authorization"]
---

# Request access token

`POST /oauth2/token`

Request an Access Token using either a client-side obtained OAuth 2.0
authorization code or a server-side JWT assertion.

An Access Token is a string that enables Box to verify that a
request belongs to an authorized session. In the normal order of
operations you will begin by requesting authentication from the
[authorize](https://developer.box.com/reference/get-authorize) endpoint and Box will send you an
authorization code.

You will then send this code to this endpoint to exchange it for
an Access Token. The returned Access Token can then be used to to make
Box API calls.

## Response `200`

Returns a new Access Token that can be used to make authenticated
API calls by passing along the token in a authorization header as
follows `Authorization: Bearer <Token>`.

- AccessToken — A token that can be used to make authenticated API calls.
  - `access_token` string, token — The requested access token.
  - `expires_in` integer — The time in seconds by which this token will expire.
  - `token_type` 'bearer' — The type of access token returned.
  - `restricted_to` ResourceScope[] — The permissions that this access token permits, providing a list of resources (files, folders, etc) and the scopes permitted for each of those resources.
    - `scope` 'annotation_edit' | 'annotation_view_all' | 'annotation_view_self' | 'base_explorer' | 'base_picker' | 'base_preview' | 'base_upload' | 'item_delete' | 'item_download' | 'item_preview' | 'item_rename' | 'item_share' | 'item_upload' | 'item_read' — The scopes for the resource access.
    - `object` union — The file or folder resource.
      - object — The bare basic representation of a folder, the minimal amount of fields returned when using the `fields` query parameter.
        - `id` string, required — The unique identifier that represent a folder. The ID for any folder can be determined by visiting a folder in the web application and copying the ID from the URL. For example, for the URL `https://*.app.box.com/folders/123` the `folder_id` is `123`.
        - `etag` string, nullable — The HTTP `etag` of this folder. This can be used within some API endpoints in the `If-Match` and `If-None-Match` headers to only perform changes on the folder if (no) changes have happened.
        - `type` 'folder', required — The value will always be `folder`.
        - `sequence_id` string — A numeric identifier that represents the most recent user event that has been applied to this item. This can be used in combination with the `GET /events`-endpoint to filter out user events that would have occurred before this identifier was read. An example would be where a Box Drive-like application would fetch an item via the API, and then listen to incoming user events for changes to the item. The application would ignore any user events where the `sequence_id` in the event is smaller than or equal to the `sequence_id` in the originally fetched resource.
        - `name` string — The name of the folder.
      - object, nullable — The bare basic representation of a file, the minimal amount of fields returned when using the `fields` query parameter.
        - `id` string, required — The unique identifier that represent a file. The ID for any file can be determined by visiting a file in the web application and copying the ID from the URL. For example, for the URL `https://*.app.box.com/files/123` the `file_id` is `123`.
        - `etag` string, nullable — The HTTP `etag` of this file. This can be used within some API endpoints in the `If-Match` and `If-None-Match` headers to only perform changes on the file if (no) changes have happened.
        - `type` 'file', required — The value will always be `file`.
        - `sequence_id` string — A numeric identifier that represents the most recent user event that has been applied to this item. This can be used in combination with the `GET /events`-endpoint to filter out user events that would have occurred before this identifier was read. An example would be where a Box Drive-like application would fetch an item via the API, and then listen to incoming user events for changes to the item. The application would ignore any user events where the `sequence_id` in the event is smaller than or equal to the `sequence_id` in the originally fetched resource.
        - `name` string — The name of the file.
        - `sha1` string, digest — The SHA1 hash of the file. This can be used to compare the contents of a file on Box with a local file.
        - `file_version` object — The information about the current version of the file.
          - `id` string, required — The unique identifier that represent a file version.
          - `type` 'file_version', required — The value will always be `file_version`.
          - `sha1` string — The SHA1 hash of this version of the file.
  - `refresh_token` string, token — The refresh token for this access token, which can be used to request a new access token when the current one expires.
  - `issued_token_type` 'urn:ietf:params:oauth:token-type:access_token', urn — The type of downscoped access token returned. This is only returned if an access token has been downscoped.

## Other responses

- `400` — An authentication error.
- `default` — An authentication error.

---

[API](https://skmtc.net/box/apis/platform-api.md) · [All operations](https://skmtc.net/box/apis/platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/box/platform-api/revisions/ba8f087e1a4d/schema)