---
title: "access token"
method: POST
path: "/v{version}/connect/token"
tags: ["Authentication Token"]
---

# access token

`POST /v{version}/connect/token`

Exchanges an auth_code for an access_token and refresh_token.
An access_token is sent with every API call when using OAuth.
When an access_token expires, the refresh_token is used to obtain a new access_token.
So, securely store these tokens for later use.
<br /><br />
The access_token should be included in the Authorization header as follows:
**Bearer {access_token}**
<br /><br />
Please see the <a href="/api/docs/v2#section/Authorization">AUTHORIZATION</a> section for a full explanation of the OAuth flow.
<br /><br />
Also accepts `application/x-www-form-urlencoded'.

## Path parameters

- `version` string, required

## Request body

- ControllersEaseConnectControllerAccessTokenRequest
  - `client_id` string, required — Your Ease Application Id (that is, the Ease Application where, for example, the redirect uri and scopes are specified).
  - `client_secret` string, required — The 'secret' that was generated for your Ease Application. This secret is only visible directly after generat it, and is not otherwise retrievable.
  - `redirect_uri` string, required — The redirect uri registered to your Application. This must exactly match the redirect uri set in the Ease Application.
  - `code` string, required
  - `grant_type` string, required — Supported grant_types are: authorization_code, and refresh_token.
  - `refresh_token` string — Only required for grant_type = refresh_token. This refresh_token is part of the response when you submit an authorization code for a new access_token.

## Response `200`

OK

- ControllersEaseConnectControllerCodeAccessTokenResponse
  - `refresh_token` string, required
  - `granted_scopes` string, required
  - `access_token` string, required — The access token usable for making API calls.
  - `expires_in` integer, required — The number of seconds before the token expires.
  - `company_id` string — The company id that the token grants access to.
  - `company_type` string — The type of company this is in Ease.
  - `token_type` string, required — The type of the token.
  - `employee_id` string — The employee id that the token grants access to.

## Other responses

- `400` — BadRequest

---

[API](https://skmtc.net/ease/apis/version-2.md) · [All operations](https://skmtc.net/ease/apis/version-2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ease/version-2/revisions/be66ed178abe/schema)