---
title: "Exchange an OAuth Token"
method: POST
path: "/sts/v1/oauth2/token"
tags: ["OAuth Tokens (sts/v1)"]
---

# Exchange an OAuth Token

`POST /sts/v1/oauth2/token`

[![General Availability](https://img.shields.io/badge/Lifecycle%20Stage-General%20Availability-%2345c6e8)](#section/Versioning/API-Lifecycle-Policy)

Use this operation to exchange an access token (JWT) issued by an external identity provider for
an access token (JWT) issued by Confluent.This enables the use of external identities
to access Confluent Cloud APIs.

## Response `200`

access token used to access public control plane api

- StsV1TokenExchangeReply — token exchange response
  - `access_token` string, required — An JWT access token, issued by Confluent, in response to the token exchange request. Client application could use the access token to access confluent public api
  - `issued_token_type` string, required — The token type. Always matches the value of requested_token_type from the request.
  - `token_type` string, required — Indicates the token type value. The only type that Confluent supports is Bearer
  - `expires_in` integer, required — The length of time, in seconds, that the access token is valid.

## Other responses

- `400` — Bad Request
- `429` — Rate Limit Exceeded
- `500` — Oops, something went wrong!

---

[API](https://skmtc.dev/confluent/apis/confluent-cloud-apis.md) · [All operations](https://skmtc.dev/confluent/apis/confluent-cloud-apis/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/confluent/confluent-cloud-apis/revisions/a6a73f98a698/schema)