---
title: "Exchange credentials for an access token"
method: POST
path: "/api/auth/token"
tags: ["auth"]
---

# Exchange credentials for an access token

`POST /api/auth/token`

[cloud-only] Exchanges authentication credentials (e.g. an authorization code) for an access token.

## Request body

- object
  - `grant_type` 'authorization_code' | 'refresh_token', required — OAuth2 grant type
  - `code` string — Authorization code (for authorization_code grant)
  - `refresh_token` string — Refresh token (for refresh_token grant)
  - `redirect_uri` string, uri — Redirect URI used in the authorization request

## Response `200`

Token response

- ExchangeTokenResponse — [cloud-only] Response containing the issued Cloud JWT and its expiry.
  - `token` string, required — Cloud JWT token
  - `expires_at` string, date-time, required — Token expiration time (RFC 3339)
  - `workspace` WorkspaceSummary, required — [cloud-only] Abbreviated workspace metadata used in list responses.
    - `id` string, required
    - `name` string, required
    - `type` 'personal' | 'team', required
  - `role` 'owner' | 'member', required — User's role in the workspace
  - `permissions` string[], required — Permission strings for the role

## Other responses

- `400` — Bad request
- `401` — Unauthorized
- `404` — Workspace not found or user not a member
- `500` — Internal server error

## Changes

- **2026-05-22** `c4db9e1283df` — 2 breaking, 3 warning, 5 info
  - removed the required property `access_token` from the response with the `200` status
  - removed the required property `token_type` from the response with the `200` status
  - removed the optional property `expires_in` from the response with the `200` status
  - removed the optional property `refresh_token` from the response with the `200` status
  - …6 more
- **2026-05-22** `09a5075587c8` — 3 info
  - api operation id `createAuthToken` removed and replaced with `exchangeToken`
  - added the non-success response with the status `404`
  - added the non-success response with the status `500`
- **2026-05-08** `c9640fded659` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/comfy-org/apis/comfyui-api/changes/api/auth/token/post.md)

---

[API](https://skmtc.dev/comfy-org/apis/comfyui-api.md) · [All operations](https://skmtc.dev/comfy-org/apis/comfyui-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/comfy-org/comfyui-api/revisions/c4db9e1283df/schema)