---
title: "OAuth 2.0 Token Endpoint"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# OAuth 2.0 Token Endpoint

`POST /oauth/token`

Implements [RFC 6749 Section 3.2](https://datatracker.ietf.org/doc/html/rfc6749#section-3.2).

Accepts either:
- **Authorization Code grant** (`grant_type=authorization_code`)
- **Refresh Token grant** (`grant_type=refresh_token`)

Client authentication is supported via:
- **HTTP Basic** (`Authorization: Basic base64(client_id:client_secret)`)
- **Form-POST** parameters (`client_id` and `client_secret` in the body)

On success, returns a JSON body containing `access_token`, `token_type`, `expires_in`,
and optionally `refresh_token` and `scope`.

## Headers

- `Authorization` string

## Response `200`

Successful token response.

- TokenResponse
  - `access_token` string, required — Bearer access token.
  - `token_type` 'Bearer', required — Token type; always "Bearer".
  - `expires_in` integer, required — Number of seconds until the access token expires.
  - `refresh_token` string, nullable — Refresh token, if issued and still valid.
  - `scope` string, nullable — Space-delimited scopes granted.

## Other responses

- `400` — Invalid request or grant (e.g., missing parameters, invalid/expired code or refresh token, unsupported grant).
- `401` — Invalid client authentication (inactive client, wrong auth method, bad secret).
- `500` — Server error.

---

[API](https://skmtc.net/reachr/apis/reachr-api-documentation.md) · [All operations](https://skmtc.net/reachr/apis/reachr-api-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/reachr/reachr-api-documentation/revisions/e4f548c8685b/schema)