---
title: "Exchange authorization code or refresh token for tokens"
method: POST
path: "/v2/auth/oauth2/token"
tags: ["OAuth2"]
---

# Exchange authorization code or refresh token for tokens

`POST /v2/auth/oauth2/token`

RFC 6749-compliant token endpoint. Pass client_id in the request body (Section 2.3.1). Use grant_type 'authorization_code' to exchange an auth code for tokens, or 'refresh_token' to refresh an access token. Accepts both application/x-www-form-urlencoded (standard per RFC 6749 Section 4.1.3) and application/json content types.

## Request body

- union
  - OAuth2ExchangeConfidentialInput
    - `client_id` string, required — The client identifier
    - `grant_type` 'authorization_code', required — The grant type — must be 'authorization_code'
    - `code` string, required — The authorization code received from the authorize endpoint
    - `redirect_uri` string, required — The redirect URI used in the authorization request
    - `client_secret` string, required — The client secret for confidential clients
  - OAuth2ExchangePublicInput
    - `client_id` string, required — The client identifier
    - `grant_type` 'authorization_code', required — The grant type — must be 'authorization_code'
    - `code` string, required — The authorization code received from the authorize endpoint
    - `redirect_uri` string, required — The redirect URI used in the authorization request
    - `code_verifier` string, required — PKCE code verifier (required for public clients that used code_challenge)
  - OAuth2RefreshConfidentialInput
    - `client_id` string, required — The client identifier
    - `grant_type` 'refresh_token', required — The grant type — must be 'refresh_token'
    - `refresh_token` string, required — The refresh token
    - `client_secret` string, required — The client secret for confidential clients
  - OAuth2RefreshPublicInput
    - `client_id` string, required — The client identifier
    - `grant_type` 'refresh_token', required — The grant type — must be 'refresh_token'
    - `refresh_token` string, required — The refresh token

## Response `200`

- OAuth2TokensDto
  - `access_token` string, required — The access token
  - `token_type` string, required — The token type
  - `refresh_token` string, required — The refresh token
  - `expires_in` number, required — The number of seconds until the access token expires

---

[API](https://skmtc.net/calcom/apis/cal-diy-api-v2.md) · [All operations](https://skmtc.net/calcom/apis/cal-diy-api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/calcom/cal-diy-api-v2/revisions/16de9d3eb7b3/schema)