---
title: "Token Endpoint"
method: POST
path: "/oauth/pg/token"
tags: ["oauth-provider", "oauth-provider"]
---

# Token Endpoint

`POST /oauth/pg/token`

OAuth 2.1 token endpoint.

Supports two grant types:
1. authorization_code: Exchange code for access + refresh tokens
2. refresh_token: Rotate tokens

Request Body:
    grant_type: "authorization_code" or "refresh_token"

    For authorization_code:
        code: Authorization code from /authorize
        code_verifier: PKCE code verifier
        client_id: OAuth client ID
        redirect_uri: Must match original request
        resource: Optional MCP server URL (RFC 9728 B2-5)

    For refresh_token:
        refresh_token: Refresh token from previous /token response
        client_id: OAuth client ID

Returns:
    access_token: JWT signed with RS256
    refresh_token: Opaque token (only for authorization_code grant)
    token_type: "Bearer"
    expires_in: Expiration in seconds
    scope: Space-separated scopes

Security Notes:
    - PKCE required for authorization_code grant
    - Refresh token rotation (old token revoked)
    - Rate limited per client
    - All tokens stored encrypted in database

Example Response:
    {
        "access_token": "eyJhbGc...",
        "refresh_token": "abc123...",
        "token_type": "Bearer",
        "expires_in": 3600,
        "scope": "focused.read focused.write"
    }

Example Error:
    {
        "error": "invalid_grant",
        "error_description": "Authorization code expired"
    }

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/priority-guard/apis/priority-guardian.md) · [All operations](https://skmtc.net/priority-guard/apis/priority-guardian/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/priority-guard/priority-guardian/versions/8579218b716d/schema)