---
title: "Exchange authorization code for tokens"
method: POST
path: "/v1/oauth/token"
tags: ["OAuth"]
---

# Exchange authorization code for tokens

`POST /v1/oauth/token`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/oauth/token`
- Auth: none required

Standard OAuth 2.0 token endpoint. Exchanges an authorization code for an
access token and optional OIDC ID token. Supports PKCE via `code_verifier`.

## Request body

- object
  - `grant_type` 'authorization_code', required
  - `code` string, required
  - `client_id` string, required
  - `redirect_uri` string, uri, required
  - `code_verifier` string: PKCE code verifier (required — PKCE S256 is mandatory for all code grants)

## Response `200`

Token response

- OAuthTokenResponse
  - `access_token` string, required
  - `token_type` 'Bearer', required
  - `expires_in` integer, required: Token lifetime in seconds
  - `refresh_token` string, nullable: Refresh token for obtaining new access tokens (when offline_access scope was granted)
  - `id_token` string, nullable: OIDC ID token (when openid scope was granted)
  - `scope` string, required

## Other responses

- `400`: Invalid grant, code, or verifier
- `401`: Invalid client credentials

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/5fa0918f3b41?raw)