---
title: "Exchange authorization code for access token"
method: POST
path: "/oauth/access_token"
tags: ["identity"]
---

# Exchange authorization code for access token

`POST /oauth/access_token`

Exchanges an OAuth 2.0 authorization code for an access token.
Used in the authorization code grant flow.

## Request body

- object
  - `client_id` string, required
  - `client_secret` string, required
  - `code` string, required
  - `grant_type` string, required
  - `redirect_uri` string, required — Must match the redirect_uri from the authorization request (used for validation only).
  - `state` string, required — Must match the state from the authorization request.

## Response `200`

Access token issued.

- object
  - `access_token` string
  - `token_type` string
  - `scope` string, nullable
  - `account_id` integer

## Other responses

- `400` — Invalid or expired authorization code, client_id mismatch, unsupported grant_type, or redirect_uri/state mismatch.
- `401` — Client authentication failed, for example an incorrect client_secret.

---

[API](https://skmtc.net/dnsimple/apis/dnsimple-api.md) · [All operations](https://skmtc.net/dnsimple/apis/dnsimple-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/dnsimple/dnsimple-api/revisions/270bb4f6f532/schema)