---
title: "Exchange credentials for JWT"
method: POST
path: "/v2/auth/token"
tags: ["Auth"]
---

# Exchange credentials for JWT

`POST /v2/auth/token`

Exchange client credentials or a refresh token for an access token.

Supports three grant types:
- Client credentials: provide client_id + client_secret.
- Refresh token: provide grant_type=refresh_token + refresh_token.
- Authorization code: provide grant_type=authorization_code + code + code_verifier + redirect_uri + client_id.

## Request body

- TokenRequest — Request body for obtaining an access token. Supports three grant types: - ``client_credentials``: provide client_id + client_secret. - ``refresh_token``: provide refresh_token. - ``authorization_code``: provide code + code_verifier + redirect_uri + client_id (PKCE S256).
  - `grant_type` 'client_credentials' | 'refresh_token' | 'authorization_code' — Grant type. Use "client_credentials" for service accounts, "refresh_token" to rotate tokens, or "authorization_code" for PKCE auth-code exchange.
  - `client_id` string, nullable — OAuth2 client ID. Required for client_credentials and authorization_code grants.
  - `client_secret` string, nullable — OAuth2 client secret. Required for client_credentials grant.
  - `refresh_token` string, nullable — Refresh token issued by a prior token exchange. Required for refresh_token grant.
  - `code` string, nullable — Authorization code. Required for authorization_code grant.
  - `code_verifier` string, nullable — PKCE code verifier. Required for authorization_code grant.
  - `redirect_uri` string, nullable — Redirect URI matching the one used at authorization. Required for authorization_code grant.

## Response `200`

OK

- TokenResponse — Successful token issuance response.
  - `access_token` string, required — Short-lived JWT for authenticating API requests. Pass as Bearer token in Authorization header.
  - `refresh_token` string, nullable — Long-lived token for obtaining new access tokens. Store securely.
  - `expires_in` integer, required — Seconds until the access_token expires.
  - `token_type` string — Always "Bearer".

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `500` — Internal Server Error

---

[API](https://skmtc.net/skilljar/apis/skilljar-api-v2.md) · [All operations](https://skmtc.net/skilljar/apis/skilljar-api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/skilljar/skilljar-api-v2/revisions/f8025de20169/schema)