---
title: "OAuth 2.0 Token Endpoint"
method: POST
path: "/restapi/oauth/token"
tags: ["OAuth 2.0 / OpenID Connect"]
---

# OAuth 2.0 Token Endpoint

`POST /restapi/oauth/token`

Returns access (and potentially refresh) tokens for making API requests.

For confidential client application types
this endpoint requires client authentication using one of the supported
methods (`client_secret_basic`, `client_secret_jwt` or `private_key_jwt`)

For non-confidential client application types
the client identifier must be provided via `client_id` request attribute.

## Response `200`

Access/Refresh Tokens

- TokenInfo
  - `access_token` string, required — OAuth access token to pass to subsequent API requests
  - `expires_in` integer, required — Access token TTL (time-to-live) in seconds
  - `refresh_token` string — OAuth refresh token (if issued)
  - `refresh_token_expires_in` integer — Refresh token TTL (time-to-live) in seconds
  - `scope` string, required — The list of space separated application permissions (OAuth scopes)
  - `token_type` 'bearer', required — Type of the token. The only supported value is `bearer`. This value should be used when specifying access token in `Authorization` header of subsequent API requests
  - `owner_id` string — Token owner's identifier. Contains RingCentral user (extension) ID
  - `endpoint_id` string — Client application instance identifier that matches the value provided by the client, or generated by the server if a client has not provided this value
  - `id_token` string — OpenID Connect ID token (if OpenID Connect flow was activated during authorization)
  - `session_expires_in` integer — Remaining time in seconds until session expiration due to absolute timeout. Returned only if absolute session timeout is enforced
  - `session_expiration_time` string, date-time — Absolute value of session expiration time in ISO date formatted string. Returned only if absolute session timeout is enforced
  - `session_id` string — OAuth session ID
  - `session_idle_timeout` integer — Nominal value of session idle timeout in seconds. Returned only if idle session timeout is enforced

## Other responses

- `400` — The response with **HTTP 400 "Bad request"** status used in some OAuth / OpenID Connect endpoints.
- `415` — Unsupported Media Type
- `429` — Request rate exceeded

---

[API](https://skmtc.net/ringcentral/apis/ringcentral-api.md) · [All operations](https://skmtc.net/ringcentral/apis/ringcentral-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/ringcentral/ringcentral-api/revisions/8d602198ec97/schema)