---
title: "Create access_token"
method: POST
path: "/auth/token"
tags: ["Auth"]
---

# Create access_token

`POST /auth/token`

Exchange an `authorization_code` for an `access-token`. The `authorization_code` is returned in the Connect `onSuccess` callback after the user successfully submits their utility credentials.

The `access_token` will not expire. Make sure you securely store it in your database so you can make future requests for the given user.

The fields `access_token_expires_in`, `refresh_token`, and `refresh_token_expires_in` can be ignored. These are included for applications using our legacy authorization framework.

## Headers

- `Pelm-Client-Id` string, required
- `Pelm-Secret` string, required

## Response `200`

Successful operation

- object
  - `access_token` string
  - `access_token_expires_in` string — number of seconds until access_token expires (1 hour)
  - `refresh_token` string
  - `refresh_token_expires_in` string — number of seconds until refresh_token expires (1 year)

## Other responses

- `400` — Client error
- `403` — Permission denied
- `500` — Server error

---

[API](https://skmtc.net/pelm/apis/pelm-api.md) · [All operations](https://skmtc.net/pelm/apis/pelm-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pelm/pelm-api/revisions/99451cd0e777/schema)