---
title: "Issue a new access token"
method: POST
path: "/api/v1/oauth2/token"
tags: ["Auth"]
---

# Issue a new access token

`POST /api/v1/oauth2/token`

Issue a new access token

## Request body

- union — Request token with given grant type - client_credentials, magic_code, google_id_token, or refresh_token
  - object
    - `grant_type` 'client_credentials', required
    - `client_id` string, uuid, required — The client ID of the partner or merchant
    - `client_secret` string, required — The client secret of the partner or merchant
  - object
    - `grant_type` 'magic_code', required
    - `email` string, email, required — Admin email address
    - `code` string — The 6-character verification code sent to email
    - `ctx` string — Optional context: "global", "partner:uuid", or "merchant:uuid"
  - object
    - `grant_type` 'google_id_token', required
    - `id_token` string, required — Google ID token obtained from Google Sign-In
    - `ctx` string — Optional context: "global", "partner:uuid", or "merchant:uuid"
  - object
    - `grant_type` 'refresh_token', required
    - `refresh_token` string, required — The refresh token obtained from a previous token request
    - `ctx` string — Optional context to switch to: "global", "partner:uuid", or "merchant:uuid".

## Response `200`

Success

- AuthTokenResponse
  - `success` boolean, required — Indicates if the request was successful
  - `data` object, required
    - `access_token` string, required — The access token to be used for authenticated requests
    - `refresh_token` string — The refresh token used to obtain a new access token. Returned only when a token is first issued (client_credentials, magic_code, google_id_token grants); the refresh grant does not return a new refresh token, so the original is reused until it expires.
    - `token_type` 'Bearer', required — The type of token issued
    - `expires_in` number, required — The number of seconds until the access token expires

## Other responses

- `400` — Bad Request
- `401` — Unauthorized

## Changes

- **2026-06-16** `b372e7d5563d` — 6 breaking, 3 warning, 4 info
  - added `subschema #1: Unauthorized Error, subschema #2` to the response body `oneOf` list for the response status `401`
  - the response's body type/format changed from `object`/`` to ``/`` for status `401`
  - the response property `data/refresh_token` became optional for the status `200`
  - the `error/code` response's property type/format changed from `string`/`` to ``/`` for status `400`
  - …9 more
- **2025-11-03** `6637b341d86d` — 1 info
  - endpoint added
- **2025-11-02** `919eb7a392aa` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/banqzinc/apis/quidkey-api/changes/api/v1/oauth2/token/post.md)

---

[API](https://skmtc.dev/banqzinc/apis/quidkey-api.md) · [All operations](https://skmtc.dev/banqzinc/apis/quidkey-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/banqzinc/quidkey-api/revisions/f86d2bdbcb08/schema)