---
title: "OAuth2 token exchange."
method: POST
path: "/oauth2/tokens"
tags: ["Enterprise"]
---

# OAuth2 token exchange.

`POST /oauth2/tokens`

## Response `200`

OK

- CodersdkOAuth2TokenResponse
  - `access_token` string
  - `expires_in` integer
  - `expiry` string, date-time — Expiry is not part of RFC 6749 but is included for compatibility with golang.org/x/oauth2.Token and clients that expect a timestamp.
  - `refresh_token` string
  - `scope` string
  - `token_type` 'Bearer' | 'DPoP'

---

[API](https://skmtc.dev/coder/apis/coder-api.md) · [All operations](https://skmtc.dev/coder/apis/coder-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/coder/coder-api/revisions/a69832b6d696/schema)