---
title: "Obtain access token"
method: POST
path: "/token"
tags: ["authorization"]
---

# Obtain access token

`POST /token`

## Request

- Base URL: `https://api.bokio.se/v1`
- URL: `https://api.bokio.se/v1/token`
- Auth: HTTP basic

OAuth 2.0 token endpoint to exchange authorization code for access token, request token with client credentials, or refresh an existing token.

- Use Authorization Code grant to obtain access token for a Company to use with the Company API.
- Use Refresh Token grant to obtain a new access token using a refresh token.
- Use Client Credentials grant without a scope to obtain a legacy General API token.
- Approved integrations may request Agency API scopes with Client Credentials for
  machine-to-machine agency access. This requires the integration to hold an approved
  agency API client-credentials privilege at the integration level.

## Request body `application/x-www-form-urlencoded`

- union
  - object
    - `grant_type` 'authorization_code', required: The grant type for the token request
    - `code` string, required: The authorization code received from the authorization server (required for authorization_code grant type)
    - `redirect_uri` string, required: The redirect URI used in the authorization request (required for authorization_code grant type)
  - object
    - `grant_type` 'refresh_token', required: The grant type for the token request
    - `refresh_token` string, required: The refresh token received from a previous token request (required for refresh_token grant type)
  - object
    - `grant_type` 'client_credentials', required: The grant type for the token request
    - `scope` string: Space-delimited Agency API scopes. Omit for the legacy General API flow.

## Response `200`

OK

- Token
  - `tenant_id` string, uuid: The id for the tenant that for this token. This field will be empty when the tenant_type is `general`
  - `tenant_type` 'general' | 'company': The type of tenant that for this token.
  - `access_token` string
  - `token_type` string
  - `expires_in` integer
  - `refresh_token` string: Returned for authorization_code and refresh_token grant types. The client_credentials grant expected that refresh are done by making another `/token` request with client_credentials grant.
  - `connection_id` string, uuid: The id for the connection that for this token. This field will be empty when the tenant_type is `general`

## Other responses

- `400`: Bad Request

---

[API](https://skmtc.dev/bokio/apis/general-api.md) - [All operations](https://skmtc.dev/bokio/apis/general-api/llms.txt) - [OpenAPI document](https://skmtc.dev/bokio/apis/general-api/revisions/991ed534dd96?raw)