---
title: "Token refresh or exchange"
method: POST
path: "/zephr/oauth2/token"
tags: ["Third Party Authentication"]
---

# Token refresh or exchange

`POST /zephr/oauth2/token`

Exchanges the OAuth2 authorization code for an access token, or refreshes an existing access token using a refresh token.

## Request body

- union
  - object
    - `grant_type` 'refresh_token', required
    - `refresh token` string
  - object
    - `grant_type` 'authorization_code', required
    - `code` string, required
    - `redirect_uri` string, uri, required

## Response `200`

OK

- union
  - Oauth2TokenExchangeResponse
    - `scope` string — The scope of the access request. Supported scopes: user.account:read, user.profile:read and user.profile:update
    - `access_token` string — The access token that can be used to obtain account and profile information
    - `token_type` string — Token type to be used in the Authorization header when requesting the resource's owner information
    - `expires_in` number — The lifetime in seconds of the access token
    - `refresh_token` string
    - `user_id` string — Zephr user identifier
  - Oauth2TokenRefreshResponse
    - `scope` string — The scope of the access request. Supported scopes: user.account:read, user.profile:read and user.profile:update
    - `access_token` string — The access token that can be used to obtain account and profile information
    - `token_type` string — Token type to be used in the Authorization header when requesting the resource's owner information
    - `expires_in` number — The lifetime in seconds of the access token
    - `user_id` string — Zephr user identifier

---

[API](https://skmtc.net/zuora/apis/admin-api-reference.md) · [All operations](https://skmtc.net/zuora/apis/admin-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/zuora/admin-api-reference/revisions/789812d35ac8/schema)