---
title: "Create an oauth token"
method: POST
path: "/oauth/token"
tags: ["oauth"]
---

# Create an oauth token

`POST /oauth/token`

Create an OAuth 2.0 Bearer token. A valid bearer token is required for all other API requests.

Be sure to set the header `Content-Type: "application/vnd.api+json"`. Otherwise, you will get an error
403 Forbidden. Using `Content-Type: "application/json"` is permitted (to support older oauth clients) but when
using `application/json` the body should have a body in the following format instead of nesting under
`data.attributes`:
```
{
  "grant_type": "client_credentials",
  "client_id": "95c78ab2-167f-40b8-8bec-8398d4b87454",
  "client_secret": "35d18dc9-a3dd-4948-b787-063a490b9354"
}
```

## Query parameters

- `include` 'groups' | 'organization'

## Request body

- CreateTokenRequest
  - `data` object, required
    - `type` 'token'
    - `attributes` object, required
      - `grant_type` 'refresh_token' | 'client_credentials', required
      - `client_id` string, required — Contact Fitbit Plus API Support to get a client id and secret.
      - `client_secret` string — Contact Fitbit Plus API Support to get a client id and secret. Secret is required if grant_type is "client_credentials"
      - `refresh_token` string — Required if grant_type is "refresh_token"

## Response `201`

Created

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `409` — Invalid Request

---

[API](https://skmtc.net/twinehealth/apis/fitbit-plus-api.md) · [All operations](https://skmtc.net/twinehealth/apis/fitbit-plus-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/twinehealth/fitbit-plus-api/versions/1c92481b5836/schema)