---
title: "Token endpoint: authorization_code + code_verifier, or refresh_token (rotation)"
method: POST
path: "/oauth/token"
tags: ["auth"]
---

# Token endpoint: authorization_code + code_verifier, or refresh_token (rotation)

`POST /oauth/token`

## Request

- Base URL: `https://cliponit.app`
- URL: `https://cliponit.app/oauth/token`
- Auth: none required

Form-encoded (RFC 6749). Returns `{access_token:"cko_…", token_type:"Bearer", expires_in:3600, refresh_token:"ckr_…", scope}` with `Cache-Control: no-store`. Codes are single use (consumed even on failure). Refresh tokens rotate: the previous one is invalidated in the same call. Errors: `invalid_request`, `invalid_grant`, `invalid_client` (401), `unsupported_grant_type`.

## Response `200`

Tokens

- object
  - `access_token` string
  - `token_type` string
  - `expires_in` integer
  - `refresh_token` string
  - `scope` string

## Other responses

- `400`: `invalid_grant` (bad/used/expired code, PKCE mismatch, bad refresh token), `invalid_request`, `unsupported_grant_type`
- `401`: `invalid_client` (client_id mismatch)

---

[API](https://skmtc.dev/cliponit/apis/cliponit-api.md) · [All operations](https://skmtc.dev/cliponit/apis/cliponit-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cliponit/apis/cliponit-api/revisions/10e3e4327922?raw)