---
title: "Get OAuth Access Token"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# Get OAuth Access Token

`POST /oauth/token`

Exchange OAuth credentials for a bearer access token. This single endpoint serves all three
supported grant types, selected by the `grant_type` form field. The client authenticates with
HTTP Basic auth (`client_id:client_secret`, base64-encoded) in the `Authorization` header.

| `grant_type` | Flow | Required fields (besides `grant_type` and `client_id`) |
|---|---|---|
| `client_credentials` | Client Credentials | `client_secret` |
| `authorization_code` | Code Authorisation | `code`, plus `redirect_uri` if multiple are registered |
| `refresh_token` | Code Authorisation | `refresh_token` |

The `authorization_code` and `refresh_token` grants belong to the Code Authorisation flow, whose
consent redirect happens in the browser before this exchange. See the
[Code Authorisation guide](/docs/guide/code-authorisation) for the full flow and redirect URI rules.

## Response `200`

OAuth access token

- TokenResponse — Response model to validate and return for oauth post notification requests.
  - `access_token` string, required — access token - can then be used directly to access protected endpoints
  - `expires_in` integer, required — token expiry in seconds
  - `refresh_token` string, nullable
  - `token_type` string, required — token type, currently always bearer

---

[API](https://skmtc.net/treasuryspring/apis/treasuryspring-public-api.md) · [All operations](https://skmtc.net/treasuryspring/apis/treasuryspring-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/treasuryspring/treasuryspring-public-api/versions/d587dda25444/schema)