---
title: "Exchange OAuth authorization code, device code, or refresh token."
method: POST
path: "/oauth/token"
tags: ["Authentication"]
---

# Exchange OAuth authorization code, device code, or refresh token.

`POST /oauth/token`

## Request

- Base URL: `https://commentary.dev`
- URL: `https://commentary.dev/oauth/token`
- Auth: none declared

## Request body

- object
  - `grant_type` 'authorization_code' | 'refresh_token' | 'urn:ietf:params:oauth:grant-type:device_code', required
  - `code` string
  - `redirect_uri` string, uri
  - `client_id` string
  - `code_verifier` string
  - `refresh_token` string
  - `device_code` string
  - `resource` string

## Response `200`

Successful response.

- OAuthToken
  - `access_token` string, required
  - `refresh_token` string, required
  - `token_type` 'Bearer', required
  - `expires_in` integer, required
  - `scope` string, required: Space-delimited scopes actually granted to this token. Registered OAuth clients may receive a subset of requested scopes.

## Other responses

- `400`: OAuth request error.
- `401`: OAuth token exchange was rejected.
- `429`: The request was rate limited.

---

[API](https://skmtc.dev/commentary/apis/commentary-public-api.md) · [All operations](https://skmtc.dev/commentary/apis/commentary-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/commentary/apis/commentary-public-api/revisions/7aaafc198c52?raw)