---
title: "OAuth token endpoint"
method: POST
path: "/public/v1/oauth/token/"
tags: ["OAuth"]
---

# OAuth token endpoint

`POST /public/v1/oauth/token/`

Accepts `application/x-www-form-urlencoded` or `application/json`.

**authorization_code grant:** `grant_type`, `code`, `code_verifier`, `client_id`, `redirect_uri`

**refresh_token grant:** `grant_type`, `refresh_token`, `client_id`

## Request body

- TokenRequest
  - `grant_type` 'authorization_code' | 'refresh_token', required — The grant type. Use authorization_code for desktop/CLI apps (requires PKCE), or refresh_token to refresh an expired access token.
  - `code` string — The authorization code received in the redirect. Required for `authorization_code` grant.
  - `code_verifier` string — PKCE code verifier. The random string used to generate the code_challenge. Required for `authorization_code` grant.
  - `client_id` string, required — The client_id returned during client registration. Required for both grant types.
  - `redirect_uri` string — Must match the redirect_uri used in the authorization request. Required for `authorization_code` grant.
  - `refresh_token` string — The refresh token from a previous token response. Required for `refresh_token` grant.
  - `resource` string — RFC 8707 resource indicator. If sent, must match the resource from the authorization request.

## Response `200`

- TokenResponse
  - `access_token` string, required — Bearer token for authenticating API requests.
  - `refresh_token` string, required — Token used to obtain a new access token when the current one expires.
  - `token_type` string, required — Always `Bearer`.
  - `expires_in` integer, required — Lifetime of the access token in seconds.
  - `scope` string, required — Space-separated list of scopes granted to this token.

## Other responses

- `400` — Invalid grant or request
- `401` — Invalid client
- `403` — Forbidden — caller is not permitted to perform this action.
- `422` — Unprocessable entity — validation failed.
- `429` — Too Many Requests — rate or capacity limit exceeded. Inspect the `Retry-After` header and the `retry_after` body field for the wait time in seconds.

---

[API](https://skmtc.net/influencers/apis/core-api-concepts.md) · [All operations](https://skmtc.net/influencers/apis/core-api-concepts/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/influencers/core-api-concepts/revisions/87e654ac822e/schema)