---
title: "OAuth 2.0 token endpoint (authorization code exchange and refresh token)"
method: POST
path: "/api/v1/oauth2/access-token/"
tags: ["Authentication"]
---

# OAuth 2.0 token endpoint (authorization code exchange and refresh token)

`POST /api/v1/oauth2/access-token/`

## Request

- Base URL: `https://partnerapi-staging.depop.com`
- URL: `https://partnerapi-staging.depop.com/api/v1/oauth2/access-token/`
- Auth: none required
- TypeScript: <https://skmtc.dev/depop/apis/seller-api/docs/api/v1/oauth2/access-token/post.ts> (a function with typed inputs; its response is checked against the schema)

Token endpoint supporting multiple grant types according to RFC 6749: - Authorization Code (Section 4.1.3): Exchange authorization code for access tokens - Refresh Token (Section 6): Exchange refresh token for new access tokens
**Authorization Code Flow:** Requires PKCE (Proof Key for Code Exchange) with S256 challenge method according to RFC 7636. The code_verifier parameter is required and must match the code_challenge from the authorization request. The scopes granted during authorization are retrieved and included in the generated access token.
**Refresh Token Flow:** Exchange a partner refresh token for a new access token and refresh token pair. The original refresh token is consumed and cannot be reused. The new refresh token maintains the same expiry as the original (1 year from initial creation).

## Request body `application/x-www-form-urlencoded`

- object
  - `grant_type` 'authorization_code' | 'refresh_token', required: OAuth 2.0 grant type - 'authorization_code' to exchange code for tokens, 'refresh_token' to refresh access token
  - `code` string: Authorization code received from the authorization endpoint (required for authorization_code grant)
  - `redirect_uri` string, uri: Redirect URI that must match the one used in authorization request (required for authorization_code grant)
  - `client_id` string, required: OAuth client identifier
  - `client_secret` string, required: OAuth client secret for authentication
  - `code_verifier` string: PKCE code verifier used to verify the code_challenge from the authorization request. Required for all authorization code flows (PKCE is mandatory). Must be 43-128 characters long and contain only [A-Za-z0-9._~-] characters. Not used for refresh_token grant.
  - `refresh_token` string: Partner refresh token to exchange for new tokens (required for refresh_token grant)

## Response `200`

Successfully exchanged authorization code or refresh token for access and refresh tokens

- OAuthTokenResponse: Partner OAuth authentication response with access and refresh tokens for authorization code flow
  - `access_token` string, required: Partner access token with 1 hour expiry
  - `refresh_token` string, required: Partner refresh token with 1 year expiry
  - `expires_in` integer, required: Access token expiry time in seconds (3600 = 1 hour)
  - `token_type` 'Bearer'

## Other responses

- `400`: Invalid token exchange request
- `401`: Unauthorized - Client authentication failed

---

[API](https://skmtc.dev/depop/apis/seller-api.md) - [All operations](https://skmtc.dev/depop/apis/seller-api/llms.txt) - [OpenAPI document](https://skmtc.dev/depop/apis/seller-api/revisions/56fef8e38e44?raw)