---
title: "Exchange an authorization code for an access token."
method: POST
path: "/v1/oauth/token"
tags: ["OAuth2"]
---

# Exchange an authorization code for an access token.

`POST /v1/oauth/token`

Token endpoint as defined by [RFC 6749 §4.1.3](https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3).

Exchange an authorization code (obtained from the
authorization endpoint) for a GitGuardian Personal Access Token
(PAT). The request and response follow the OAuth 2.0 spec.

This endpoint does not require authentication: the client
authenticates itself by submitting the `client_id` (and
`client_secret` for confidential clients) in the request body.

## Response `200`

Token successfully issued.

- object
  - `access_token` string, required — The issued personal access token. Use it in the `Authorization: Token <access_token>` header for subsequent calls to the GitGuardian API.
  - `token_type` 'Bearer', required
  - `expires_in` integer, nullable — Seconds until the access token expires. `null` if the token never expires.
  - `type` string, required — GitGuardian token type.
  - `name` string, required — Token name.
  - `account_id` integer, required — ID of the GitGuardian workspace the token belongs to.
  - `expire_at` string, date-time, nullable — Expiration date of the token (`null` if it never expires).
  - `scope` string[], required — Scopes granted to the token.
  - `key` string, required — Raw token value (legacy alias of `access_token`, kept for backwards compatibility).
  - `expire_at_downsized` boolean, required — `true` if the requested lifetime was capped by a workspace policy and the token expires earlier than requested.

## Other responses

- `400` — OAuth 2.0 error response ([RFC 6749 §5.2](https://www.rfc-editor.org/rfc/rfc6749#section-5.2)). Returned for example when the authorization code is invalid, expired, the PKCE verifier does not match, or the request is otherwise malformed.
- `401` — OAuth 2.0 error response when client authentication fails (unknown `client_id` or invalid `client_secret`).

---

[API](https://skmtc.net/gitguardian/apis/gitguardian-api.md) · [All operations](https://skmtc.net/gitguardian/apis/gitguardian-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gitguardian/gitguardian-api/revisions/511b067cdcb1/schema)