---
title: "[cloud-only] Exchange authorization code or refresh token for a resource-bound access token"
method: POST
path: "/oauth/token"
tags: ["auth"]
---

# [cloud-only] Exchange authorization code or refresh token for a resource-bound access token

`POST /oauth/token`

[cloud-only] OAuth 2.1 token endpoint (RFC 6749 §3.2). Public clients only — `client_secret` is rejected.

Two grant types are supported:
- `authorization_code` — exchanges the code minted by `/oauth/authorize` (with PKCE verifier) for an access token + first refresh token. Single-use; reuse fails closed.
- `refresh_token` — rotates the refresh token. Old token immediately invalid; presenting an already-rotated token revokes the entire token family and emits a security metric.

Both grant types re-validate canonical user state, current workspace membership, and the resource's active flag at every mint. A code or refresh token bound to a deactivated resource fails closed.

Errors follow RFC 6749 §5.2. Logs never contain raw codes, refresh tokens, or minted tokens.

Per RFC 6749 §5.1, every 200 and 400 response carries `Cache-Control: no-store` and `Pragma: no-cache` so intermediaries cannot cache token-bearing or state-change-reason responses.

## Response `200`

New token pair

- OAuthTokenResponse — [cloud-only] RFC 6749 §5.1 successful token response.
  - `access_token` string, required — Resource-bound access token (audience matches the protected resource).
  - `token_type` 'Bearer', required
  - `expires_in` integer, required — Access token lifetime in seconds.
  - `refresh_token` string, required — Opaque refresh token. Rotates on every successful refresh; presenting an already-rotated token revokes the entire family.
  - `scope` string, required — Space-delimited scopes granted with this token.

## Other responses

- `400` — RFC 6749 §5.2 error
- `404` — OAuth disabled

## Changes

- **2026-05-21** `eda7dd3d95f1` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/comfy-org/apis/comfyui-api/changes/oauth/token/post.md)

---

[API](https://skmtc.dev/comfy-org/apis/comfyui-api.md) · [All operations](https://skmtc.dev/comfy-org/apis/comfyui-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/comfy-org/comfyui-api/revisions/c4db9e1283df/schema)