---
title: "Token endpoint (authorization code or refresh token)"
method: POST
path: "/token"
tags: ["POST token"]
---

# Token endpoint (authorization code or refresh token)

`POST /token`

Issues or refreshes access tokens. `application/x-www-form-urlencoded` is the standard encoding; `application/json` with the same field names is also accepted.

## Request body

- union — Token request for either supported grant type.
  - OAuthAuthorizationCodeTokenRequest
    - `grant_type` 'authorization_code', required — Use `authorization_code` for the initial exchange.
    - `code` string, required — Authorization code from `GET /authorize` callback.
    - `redirect_uri` string, required — Same redirect URI used in the authorize request.
    - `client_id` string, required — OAuth client id (public UID).
    - `client_secret` string, required — OAuth client secret for confidential clients.
  - OAuthRefreshTokenRequest
    - `grant_type` 'refresh_token', required — Use `refresh_token` to rotate access.
    - `refresh_token` string, required — Issued refresh token.
    - `redirect_uri` string, required — Same redirect URI associated with the client.
    - `client_id` string, required — OAuth client id (public UID).
    - `client_secret` string, required — OAuth client secret for confidential clients.

## Response `200`

Access token response from the token endpoint.

- OAuthAccessTokenSuccessResponse
  - `access_token` string, required — Bearer access token to use in the Intake Form API authorization header.
  - `token_type` string, required — Token type; value is `Bearer`.
  - `expires_in` integer, required — Lifetime of the access token in seconds from issuance.
  - `refresh_token` string, required — Token used to issue a new access token without going through the authorize process again. Refresh tokens do not expire until the new access token it granted is used.
  - `scope` string, required — Granted scope string.
  - `created_at` integer, required — Unix timestamp when the token was created.

## Other responses

- `400` — Invalid grant, unsupported grant type, or validation error. User must be logged in to get the initial access token based on authorization_code.
- `401` — Client authentication failed.
- `429` — Too many requests to OAuth authorization endpoints. Limit is 500 requests per minute (combined across authorization-related traffic when rate limiting applies).

---

[API](https://skmtc.net/healthsherpa/apis/health-insurance-quotes-api.md) · [All operations](https://skmtc.net/healthsherpa/apis/health-insurance-quotes-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/healthsherpa/health-insurance-quotes-api/revisions/3cbfff4e5929/schema)