---
title: "Exchange or refresh OAuth tokens"
method: POST
path: "/v3/oauth/token"
tags: ["OAuth"]
---

# Exchange or refresh OAuth tokens

`POST /v3/oauth/token`

No OAuth installation scope. OAuth flow endpoint. Confidential clients authenticate with `client_secret_post` or HTTP Basic auth. Public client registrations with `token_endpoint_auth_method=none` omit `client_secret` and must use PKCE.

## Request body

- OAuthTokenRequest
  - `grant_type` 'authorization_code' | 'refresh_token', required
  - `client_id` string, required — OAuth application client ID, registered client ID, or HTTPS Client ID Metadata Document URL.
  - `client_secret` string — Required for confidential clients when HTTP Basic auth is not used. Omit for public client registrations using `token_endpoint_auth_method=none` and for clients using `private_key_jwt`.
  - `client_assertion_type` string — Required for `private_key_jwt`; must be `urn:ietf:params:oauth:client-assertion-type:jwt-bearer`.
  - `client_assertion` string — Signed JWT client assertion required for `private_key_jwt`.
  - `code` string — Authorization code, required for `authorization_code`.
  - `redirect_uri` string, uri — Redirect URI used on the authorization request.
  - `code_verifier` string — PKCE code verifier. Required for public clients and recommended for all authorization-code exchanges.
  - `refresh_token` string — Refresh token, required for `refresh_token`.
  - `resource` string, uri — Optional resource audience. Must match the resource requested during authorization when present. Official Scalev MCP DCR/CIMD clients may omit it when the authorization session is already MCP-bound.

## Response `200`

Success

- RawObjectResponseBody — Raw single-resource success payload for v3.

## Other responses

- `400` — Bad Request

---

[API](https://skmtc.net/scalev/apis/nexus-commerce-api.md) · [All operations](https://skmtc.net/scalev/apis/nexus-commerce-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/scalev/nexus-commerce-api/versions/4354959d76dc/schema)