---
title: "Exchange authorization code for access token"
method: POST
path: "/oauth/access_token"
tags: ["identity"]
---

# Exchange authorization code for access token

`POST /oauth/access_token`

Exchanges an OAuth 2.0 authorization code for an access token.
Used in the authorization code grant flow.

## Request body

- object
  - `client_id` string, required
  - `client_secret` string, required
  - `code` string, required
  - `grant_type` string, required
  - `redirect_uri` string, required — Must match the redirect_uri from the authorization request (used for validation only).
  - `state` string, required — Must match the state from the authorization request.

## Response `200`

Access token issued.

- object
  - `access_token` string
  - `token_type` string
  - `scope` string, nullable
  - `account_id` integer

## Other responses

- `400` — Invalid or expired authorization code, client_id mismatch, unsupported grant_type, or redirect_uri/state mismatch.
- `401` — Client authentication failed, for example an incorrect client_secret.

## Changes

- **2026-06-03** (v2) `ea5d6dcaf721` — 1 info
  - added the non-success response with the status `401`
- **2026-02-24** (v2) `b7ae4d9fe489` — 1 info
  - endpoint added
- **2023-07-18** (v2) `c8591dcf8c29` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/dnsimple/apis/dnsimple-api/changes/oauth/access_token/post.md)

---

[API](https://skmtc.dev/dnsimple/apis/dnsimple-api.md) · [All operations](https://skmtc.dev/dnsimple/apis/dnsimple-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/dnsimple/dnsimple-api/revisions/ea5d6dcaf721/schema)