Skip to main content
POST
OAuth token endpoint

Form-encoded token exchange (OAuth 2.1)

Exchanges an authorization code for tokens, or rotates a refresh token. The request body is application/x-www-form-urlencoded (per RFC 6749), not JSON.
  • grant_type=authorization_code — send code, redirect_uri, client_id, and the PKCE code_verifier matching the code_challenge from the authorize step.
  • grant_type=refresh_token — send refresh_token. Refresh tokens rotate: each use returns a new one and invalidates the old (reuse is detected and revokes the chain).
Returns a short-lived opaque access token (use it as Authorization: Bearer ...), a rotating refresh token, token_type, and expires_in. Access tokens last ~1 hour; refresh tokens ~30 days.

Body

application/json

authorization_code or refresh_token grant. Accepts application/x-www-form-urlencoded (the OAuth default) OR application/json.

grant_type
string
required
client_id
string | null
client_secret
string | null

Confidential-client secret (client_secret_post). Public clients omit it and rely on PKCE.

code
string | null
code_verifier
string | null
device_code
string | null

Device Authorization Grant (RFC 8628): the opaque device_code the client polls with. Carries its own PKCE code_verifier, same as the auth-code grant.

redirect_uri
string | null
refresh_token
string | null

Response

Access token + rotating refresh token

access_token
string
required
expires_in
integer<int64>
required
refresh_token
string
required
scope
string
required

Space-delimited granted scopes (RFC 6749 §5.1).

token_type
string
required