---
title: "Get a user access token"
method: GET
path: "/v3/oauth2/token"
tags: ["authentication"]
---

# Get a user access token

`GET /v3/oauth2/token`

Client provides authorization token obtained from /api/v3/oauth2/authorize to this endpoint and receives an access token. Access token can then be used to query API endpoints. ### Request Access Token After user approves your access to the given scope form the https:/app.quantimo.do/v1/oauth2/authorize endpoint, you'll receive an authorization code to request an access token. This time make a `POST` request to `/api/v1/oauth/access_token` with parameters including: * `grant_type` Can be `authorization_code` or `refresh_token` since we are getting the `access_token` for the first time we don't have a `refresh_token` so this must be `authorization_code`. * `code` Authorization code you received with the previous request. * `redirect_uri` Your application's redirect url. ### Refreshing Access Token Access tokens expire at some point, to continue using our api you need to refresh them with `refresh_token` you received along with the `access_token`. To do this make a `POST` request to `/api/v1/oauth/access_token` with correct parameters, which are: * `grant_type` This time grant type must be `refresh_token` since we have it. * `clientId` Your application's client id. * `client_secret` Your application's client secret. * `refresh_token` The refresh token you received with the `access_token`. Every request you make to this endpoint will give you a new refresh token and make the old one expired. So you can keep getting new access tokens with new refresh tokens. ### Using Access Token Currently we support 2 ways for this, you can't use both at the same time. * Adding access token to the request header as `Authorization: Bearer {access_token}` * Adding to the url as a query parameter `?access_token={access_token}` You can read more about OAuth2 from [here](http://oauth.net/2/)

## Query parameters

- `clientId` string
- `client_secret` string
- `grant_type` string, required
- `code` string, required
- `response_type` string, required
- `scope` string, required
- `redirect_uri` string
- `state` string

## Response `200`

Successful Operation

## Other responses

- `401` — Not Authenticated

---

[API](https://skmtc.net/quantimo/apis/curedao-unified-health-api.md) · [All operations](https://skmtc.net/quantimo/apis/curedao-unified-health-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/quantimo/curedao-unified-health-api/revisions/7ac03025c3d2/schema)