---
title: "Generate or refresh an access token"
method: POST
path: "/connect/token"
tags: ["Access tokens"]
---

# Generate or refresh an access token

`POST /connect/token`

Generate an `access_token`you can use to make requests to our APIs. Choose:

* Option 1 to generate an `access_token` and `refresh_token` for the Data API.
* Option 2 to generate a new `access_token` for the Data API using a `refresh_token`.
* Option 3 to generate an `access_token` for the Payments API v3.

## Request body

- union
  - TokenExchangeRequest
    - `client_id` string, required — The Client Id found in TrueLayer Console
    - `client_secret` string, required — The Client Secret found in TrueLayer Console
    - `code` string, required — The code returned from the auth session
    - `grant_type` 'authorization_code', required — The grant type to use must be `authorization_code`
    - `redirect_uri` string, uri, required — The Redirect URI allowlisted in TrueLayer Console
    - `code_verifier` unknown
  - TokenRefreshRequest
    - `grant_type` string, required — The grant type to use (must be `refresh_token`)
    - `client_id` string, required — The client_id found in TrueLayer Console
    - `client_secret` string, required — The client secret found in TrueLayer Console
    - `refresh_token` string, required — The refresh_token returned from the auth session
  - ClientCredentialsGrantRequest
    - `grant_type` 'client_credentials', required — The grant type to use must be `client_credentials`
    - `client_id` string, required — The Client Id found in TrueLayer Console
    - `client_secret` string, required — The Client Secret found in TrueLayer Console
    - `scope` string, required — A space separated list of scopes. Scopes for the Payments API v3\: - `payments` - `recurring_payments:sweeping` - `recurring_payments:commercial` - `signupplus` Scopes for the Verification API\: - `verification` Scopes for deprecated payments APIs\: - `payouts` - `paydirect`

## Response `200`

Successful response returns `access_token` and optionally `refresh_token`.

- TokenExchangeResponse
  - `access_token` string, required — A short-lived JWT token used to access data on behalf of the End user
  - `expires_in` integer, required — `access_token` validity in seconds. Default is 1 hour or specified by provider whichever is lower.
  - `refresh_token` string — A long-lived code used to obtain a new `access_token` when expired. It will be returned only if the scope `offline_access` was requested
  - `token_type` string, required — Type of token returned. Must be `Bearer`
  - `scope` string — The scope of the `access_token`. It will be a space-separated list of scopes granted to the `access_token`.

## Other responses

- `400` — Bad Request
- `500` — Internal Server Error

---

[API](https://skmtc.net/truelayer/apis/authentication-server.md) · [All operations](https://skmtc.net/truelayer/apis/authentication-server/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/truelayer/authentication-server/revisions/5f6051515b2c/schema)