---
title: "Token endpoint"
method: POST
path: "/token"
tags: ["Identity Provider"]
---

# Token endpoint

`POST /token`

## Request

- Base URL: `https://id.deadsimple.email`
- URL: `https://id.deadsimple.email/token`
- Auth: none required

Exchanges an authorization code (with `code_verifier`) or a refresh token. Codes are single use and live 5 minutes; a failed exchange burns the code. Client authentication: `client_secret_basic`, `client_secret_post`, or `none` (open clients and registered public clients). Registered clients, and any grant that included `offline_access`, receive a refresh token (30 days, rotated on every use; a reused refresh token is rejected). Accepts application/x-www-form-urlencoded or JSON.

## Response `200`

Tokens issued.

- IdentityTokenResponse
  - `access_token` string: Opaque dse_idt_ token for /userinfo. Lives 1 hour.
  - `token_type` string
  - `expires_in` integer
  - `id_token` string: ES256 JWT, verify against /.well-known/jwks.json. Lives 1 hour.
  - `scope` string
  - `refresh_token` string: dse_idr_ token, 30 days, rotated on every use. Only for registered clients or when offline_access was granted.

## Other responses

- `400`: invalid_request, invalid_grant (bad or reused code, PKCE mismatch, redirect_uri mismatch), or unsupported_grant_type.
- `401`: invalid_client. Registered clients that require a secret get a WWW-Authenticate Basic challenge.

---

[API](https://skmtc.dev/deadsimple/apis/dead-simple-email-api.md) · [All operations](https://skmtc.dev/deadsimple/apis/dead-simple-email-api/llms.txt) · [OpenAPI document](https://skmtc.dev/deadsimple/apis/dead-simple-email-api/revisions/c697881be131?raw)