---
title: "Generate a token"
method: POST
path: "/oauth/token"
tags: ["oauth"]
---

# Generate a token

`POST /oauth/token`

## Request

- Base URL: `https://{tenant_name}.benchling.com`
- URL: `https://{tenant_name}.benchling.com/oauth/token`
- Auth: HTTP bearer

Generate a token for usage with authenticating via OAuth2 in subsequent API calls.

Supports the following grant types:
- `client_credentials` — exchange client ID and secret for an access token.
- `authorization_code` — exchange an authorization code (from the OAuth2 authorize flow) for an access token and refresh token. Requires `code`, `redirect_uri`, and optionally `code_verifier` (for PKCE) and `state`.
- `refresh_token` — exchange a refresh token for a new access token and refresh token.

**Note:** This endpoint is available at the absolute URL `/oauth/token` (not relative to the versioned API base path).

## Request body

- object
  - `client_id` string: ID of client to request token for. Leave off if client ID and secret are being supplied through Authorization header.
  - `client_secret` string: Leave off if client ID and secret are being supplied through Authorization header.
  - `code` string: Authorization code received from the authorize endpoint. Required when grant_type is authorization_code.
  - `code_verifier` string: PKCE code verifier. Required when grant_type is authorization_code and a code_challenge was sent in the authorization request.
  - `grant_type` 'client_credentials' | 'authorization_code' | 'refresh_token', required
  - `redirect_uri` string: Redirect URI that was used in the authorization request. Required when grant_type is authorization_code.
  - `refresh_token` string: Refresh token to exchange for a new access token. Required when grant_type is refresh_token.
  - `state` string: Optional state parameter for the authorization_code grant type.

## Response `200`

Generated token

- OauthGetTokenResponse200
  - `access_token` string, required
  - `expires_in` integer, required: Number of seconds that the access token is valid for
  - `refresh_token` string: Refresh token. Returned when grant_type is authorization_code or refresh_token.
  - `refresh_token_expires_in` integer: Number of seconds that the refresh token is valid for. Returned when a refresh_token is included in the response.
  - `token_type` 'Bearer', required

## Other responses

- `400`: Bad Request
- `401`: Unauthorized

---

[API](https://skmtc.dev/benchling/apis/benchling-api.md) - [All operations](https://skmtc.dev/benchling/apis/benchling-api/llms.txt) - [OpenAPI document](https://skmtc.dev/benchling/apis/benchling-api/revisions/c9f087b98b8b?raw)