---
title: "Request a Token"
method: POST
path: "/token"
tags: ["Authorization"]
---

# Request a Token

`POST /token`

This endpoint is used to request a token from the authorization server. If requesting an initial token in the Authorization Code grant, an authorization code, client ID, and client secret must be provided. If requesting to refresh an existing token in the Authorization Code grant, a refresh token, client ID, and client secret must be provided. If requesting a token via the Client Credentials grant, a client ID and secret must be provided. See endpoint [specification](https://datatracker.ietf.org/doc/html/rfc6749#section-3.2).

## Headers

- `Authorization` string

## Request body

- union
  - object
    - `grant_type` 'authorization_code', required — The grant type for the request. Must be set to 'authorization_code' for the Authorization Code grant initial token request.
    - `code` string, required — The authorization code received from the authorization server.
    - `redirect_uri` string, required — The client applications redirect URI. Must be registered on the client application and consistent throughout the authorization transaction.
    - `client_id` string — The client ID of the client application issued at registration. Required if not provided in the Authorization header.
    - `client_secret` string — The client secret of the client application issued at registration. Required if not provided in the Authorization header.
  - object
    - `grant_type` 'refresh_token', required — The grant type for the request. Must be set to 'refresh_token' for the Authorization Code grant refresh token request.
    - `refresh_token` string, required — The refresh token received from the authorization server for the access token being refreshed.
    - `scope` string — Specifies the level of access that your client application is requesting. It should be a space-separated string of Ironclad resource scopes that can be found on the client application registration page. The scopes requested must be equal to or a subset of the client application’s registered scopes and the previously granted scopes. When ommitted, the previously granted scopes are used.
    - `client_id` string — The client ID of the client application issued at registration. Required if not provided in the Authorization header.
    - `client_secret` string — The client secret of the client application issued at registration. Required if not provided in the Authorization header.
  - object
    - `grant_type` 'client_credentials', required — The grant type for the request. Must be set to 'client_credentials' for the Client Credentials grant token request.
    - `scope` string — Specifies the level of access that your client application is requesting. It should be a space-separated string of Ironclad resource scopes that can be found on the client application registration page. The scopes requested must be equal to or a subset of the client application’s registered scopes.
    - `client_id` string — The client ID of the client application issued at registration. Required if not provided in the Authorization header.
    - `client_secret` string — The client secret of the client application issued at registration. Required if not provided in the Authorization header.

## Response `200`

A successful response will return the relevant token details.

- union
  - AuthorizationCodeGrantTokenResponse — Response for an Authorization Code grant token request. Will include the token scope if scope was requested.
    - `token_type` string, required
    - `access_token` string, required
    - `refresh_token` string, required
    - `expires_in` integer, required
    - `scope` string
  - ClientCredentialsGrantTokenResponse — Response for an Client Credentials grant token request. Will include the token scope if scope was requested.
    - `token_type` string, required
    - `access_token` string, required
    - `expires_in` integer, required
    - `scope` string

## Other responses

- `400` — If the request is missing required parameters or has invalid parameters, the client will receive either an 'invalid_request' or 'invalid_scope' response.
- `401` — If the client associated with the initial authorization request does not match the client requesting the token or if the client associated with a token does not match the client requesting a token refresh, the client will receive an 'invalid_client' response.
- `403` — If the client is not authorized to use a particular grant, the client will receive an 'unauthorized_client' response. If the request includes an invalid authorization code, an invalid refresh token, or an invalid redirect URI, the client will receive an 'invalid_grant' response.

---

[API](https://skmtc.net/ironcladapp/apis/ironclad-public-api.md) · [All operations](https://skmtc.net/ironcladapp/apis/ironclad-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ironcladapp/ironclad-public-api/versions/9459b4cfc1e0/schema)