---
title: "OAuth Token Endpoint"
method: POST
path: "/v1/oauth/token"
tags: ["OAuth"]
---

# OAuth Token Endpoint

`POST /v1/oauth/token`

Endpoint for receiving access, ID, and refresh tokens from Bolt's OAuth server. 

To use this endpoint, first use the Authorization Code Request flow by using the `authorization_code` Grant Type (`grant_type`). Then, in the event that you would need a second or subsequent code, use the `refresh_token` value returned from a successful request as the `refresh_token` input value in your subsequent `refresh_token` Grant Type (`grant_type`) request.

 **Reminder - the Content-Type of this request must be application/x-www-form-urlencoded**

## Headers

- `X-Publishable-Key` string

## Response `200`

OAuth token response.

- OAuthTokenResponse
  - `access_token` string — An access token you can use to make requests on behalf of a Bolt Account.
  - `expires_in` integer — Access token’s expiration in seconds.
  - `id_token` string — A JWT token issued when the request includes the scope open_id.
  - `refresh_token` string — A refresh token you can use to issue a brand new access token without obtaining a new authorization code.
  - `refresh_token_scope` string — The scope granted to the refresh token. Currently this will always be bolt.account.view.
  - `scope` string — The scope granted to access token, depending on the scope granted to the authorization code as well as the scope parameter. Options include `bolt.account.manage`, `bolt.account.view`, `openid`.
  - `token_type` string — The token_type will always be bearer.

## Other responses

- `400` — Invalid request to OAuth Token.
- `403` — Forbidden request to OAuth Token.
- `422` — Unprocessable request to OAuth Token.

---

[API](https://skmtc.dev/bolt/apis/bolt-api-reference.md) · [All operations](https://skmtc.dev/bolt/apis/bolt-api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/bolt/bolt-api-reference/revisions/1f62c40558c6/schema)