---
title: "POST /v1/oauth/token"
method: POST
path: "/v1/oauth/token"
tags: ["oauth"]
---

# POST /v1/oauth/token

`POST /v1/oauth/token`

This endpoint implements the OAuth 2.0 `token` endpoint, as part of the Authorization Code flow with Proof Key for Code Exchange (PKCE). For more information, see [Authentication](https://www.canva.dev/docs/connect/authentication/).

To generate an access token, you must provide one of the following:

- An authorization code
- A refresh token

Generating a token using either an authorization code or a refresh token allows your integration to act on behalf of a user. You must first [obtain user authorization and get an authorization code](https://www.canva.dev/docs/connect/authentication/#obtain-user-authorization).

Access tokens may be up to 4 KB in size, and are only valid for a specified period of time. The expiry time (currently 4 hours) is shown in the endpoint response and is subject to change.

**Endpoint authentication**

Requests to this endpoint require authentication with your client ID and client secret, using _one_ of the following methods:

- **Basic access authentication** (Recommended): For [basic access authentication](https://en.wikipedia.org/wiki/Basic_access_authentication), the `{credentials}` string must be a Base64 encoded value of `{client id}:{client secret}`.
- **Body parameters**: Provide your integration's credentials using the `client_id` and `client_secret` body parameters.

This endpoint can't be called from a user's web-browser client because it uses client authentication with client secrets. Requests must come from your integration's backend, otherwise they'll be blocked by Canva's [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) policy.

**Generate an access token using an authorization code**

To generate an access token with an authorization code, you must:

- Set `grant_type` to `authorization_code`.
- Provide the `code_verifier` value that you generated when creating the user authorization URL.
- Provide the authorization code you received after the user authorized the integration.

**Generate an access token using a refresh token**

Using the `refresh_token` value from a previous user token request, you can get a new access token with the same or smaller scope as the previous one, but with a refreshed expiry time. You will also receive a new refresh token that you can use to refresh the access token again.

To refresh an existing access token, you must:

- Set `grant_type` to `refresh_token`.
- Provide the `refresh_token` from a previous token request.

## Response `200`

OK

- ExchangeAccessTokenResponse — Exchange auth token to access token.
  - `access_token` string, required — The bearer access token to use to authenticate to Canva Connect API endpoints. If requested using a `authorization_code` or `refresh_token`, this allows you to act on behalf of a user.
  - `refresh_token` string, required — The token that you can use to refresh the access token.
  - `token_type` string, required — The token type returned. This is always `Bearer`.
  - `expires_in` integer, required — The expiry time (in seconds) for the access token.
  - `scope` string — The [scopes](https://www.canva.dev/docs/connect/appendix/scopes/) that the token has been granted.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `429` — Too Many Requests
- `default` — Error Response

---

[API](https://skmtc.net/canva/apis/canva-connect-api.md) · [All operations](https://skmtc.net/canva/apis/canva-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/canva/canva-connect-api/versions/499c392c7720/schema)