---
title: "Issues access and refresh tokens based on grant type."
method: POST
path: "/token"
tags: ["auth"]
---

# Issues access and refresh tokens based on grant type.

`POST /token`

## Query parameters

- `grant_type` 'password' | 'refresh_token' | 'id_token' | 'pkce' | 'web3', required

## Request body

- object — For the refresh token flow, supply only `refresh_token`. For the email/phone with password flow, supply `email`, `phone` and `password` with an optional `gotrue_meta_security`. For the OIDC ID token flow, supply `id_token`, `nonce`, `provider`, `client_id`, `issuer` with an optional `gotrue_meta_security`. For the Web3 flow, supply `message`, `signature`, and `chain`.
  - `refresh_token` string
  - `password` string
  - `email` string, email
  - `phone` string, phone
  - `id_token` string
  - `access_token` string — Provide only when `grant_type` is `id_token` and the provided ID token requires the presence of an access token to be accepted (usually by having an `at_hash` claim).
  - `nonce` string
  - `provider` 'google' | 'apple' | 'azure' | 'facebook' | 'keycloak'
  - `client_id` string
  - `issuer` string — If `provider` is `azure` then you can specify any Azure OIDC issuer string here, which will be used for verification.
  - `gotrue_meta_security` GoTrueSecurity — Use this property to pass a CAPTCHA token only if you have enabled CAPTCHA protection.
    - `captcha_token` string
  - `auth_code` string, uuid
  - `code_verifier` string
  - `message` string — Signed message for Web3 authentication following the Sign in with Solana (SIWS) or Sign in with Ethereum (SIWE) standard. Must include: `Issued At`, `URI`, `Version`.
  - `signature` string — The signature of the message for Web3 authentication. For Solana: Base64 or Base64-URL encoded. For Ethereum: hexadecimal string with 0x prefix.
  - `chain` 'solana' | 'ethereum' — What blockchain is the Web3 message and signature for.

## Response `200`

An access and refresh token have been successfully issued.

- AccessTokenResponseSchema
  - `access_token` string — A valid JWT that will expire in `expires_in` seconds.
  - `refresh_token` string — An opaque string that can be used once to obtain a new access and refresh token.
  - `token_type` string — What type of token this is. Only `bearer` returned, may change in the future.
  - `expires_in` integer — Number of seconds after which the `access_token` should be renewed by using the refresh token with the `refresh_token` grant type.
  - `expires_at` integer — UNIX timestamp after which the `access_token` should be renewed by using the refresh token with the `refresh_token` grant type.
  - `weak_password` object — Only returned on the `/token?grant_type=password` endpoint. When present, it indicates that the password used is weak. Inspect the `reasons` and/or `message` properties to identify why.
    - `reasons` string[]
    - `message` string
  - `user` UserSchema — Object describing the user related to the issued access and refresh tokens.
    - `id` string, uuid
    - `aud` string
    - `role` string
    - `email` string — User's primary contact email. In most cases you can uniquely identify a user by their email address, but not in all cases.
    - `email_confirmed_at` string, date-time
    - `phone` string, phone — User's primary contact phone number. In most cases you can uniquely identify a user by their phone number, but not in all cases.
    - `phone_confirmed_at` string, date-time
    - `confirmation_sent_at` string, date-time
    - `confirmed_at` string, date-time
    - `recovery_sent_at` string, date-time
    - `new_email` string, email
    - `email_change_sent_at` string, date-time
    - `new_phone` string, phone
    - `phone_change_sent_at` string, date-time
    - `reauthentication_sent_at` string, date-time
    - `last_sign_in_at` string, date-time
    - `app_metadata` object
    - `user_metadata` object
    - `factors` MFAFactorSchema[]
      - `id` string, uuid
      - `status` string — Usually one of: - verified - unverified
      - `friendly_name` string
      - `factor_type` string — Usually one of: - totp - phone - webauthn
      - `webauthn_credential` string
      - `phone` string, phone, nullable
      - `created_at` string, date-time
      - `updated_at` string, date-time
      - `last_challenged_at` string, date-time, nullable
    - `identities` IdentitySchema[]
      - `identity_id` string, uuid
      - `id` string, uuid
      - `user_id` string, uuid
      - `identity_data` object
      - `provider` string
      - `last_sign_in_at` string, date-time
      - `created_at` string, date-time
      - `updated_at` string, date-time
      - `email` string, email
    - `banned_until` string, date-time
    - `created_at` string, date-time
    - `updated_at` string, date-time
    - `deleted_at` string, date-time
    - `is_anonymous` boolean

## Other responses

- `400` — HTTP Bad Request response. Can occur if the passed in JSON cannot be unmarshalled properly or when CAPTCHA verification was not successful. In certain cases can also occur when features are disabled on the server (e.g. sign ups). It may also mean that the operation failed due to some constraint not being met (such a user already exists for example).
- `401` — HTTP Forbidden response.
- `403` — HTTP Unauthorized response.
- `429` — HTTP Too Many Requests response, when a rate limiter has been breached.
- `500` — HTTP Internal Server Error.

---

[API](https://skmtc.net/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.net/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/versions/2664b89bee49/schema)