---
title: "Token"
method: POST
path: "/api/oauth/token"
tags: ["oauth"]
---

# Token

`POST /api/oauth/token`

OAuth 2.0 Token Endpoint

Exchanges authorization code or refresh token for access token.

Grant Types:
1. authorization_code: Exchange authorization code for tokens
   - Required: grant_type, code, redirect_uri, client_id, client_secret
   - Optional: code_verifier (required if PKCE was used)

2. refresh_token: Exchange refresh token for new access token
   - Required: grant_type, refresh_token, client_id, client_secret

Returns:
- access_token: Bearer token for API access (1 hour TTL)
- token_type: "Bearer"
- expires_in: Seconds until access token expires
- refresh_token: Token for refreshing access (30 days TTL)
- scopes: List of scopes

## Request body

- union
  - TokenRequestByCode
    - `grant_type` 'authorization_code', required
    - `code` string, required — Authorization code
    - `redirect_uri` string, required — Redirect URI (must match authorization request)
    - `client_id` string, required
    - `client_secret` string, required
    - `code_verifier` string, required — PKCE code verifier
  - TokenRequestByRefreshToken
    - `grant_type` 'refresh_token', required
    - `refresh_token` string, required
    - `client_id` string, required
    - `client_secret` string, required

## Response `200`

Successful Response

- TokenResponse — OAuth 2.0 token response
  - `token_type` 'Bearer'
  - `access_token` string, required
  - `access_token_expires_at` string, date-time, required
  - `refresh_token` string, required
  - `refresh_token_expires_at` string, date-time, required
  - `scopes` string[], required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/significant-gravitas/apis/autogpt-agent-server.md) · [All operations](https://skmtc.net/significant-gravitas/apis/autogpt-agent-server/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/significant-gravitas/autogpt-agent-server/versions/382041c7ecb2/schema)