---
title: "OAuth token endpoint"
method: POST
path: "/api/oauth/token"
tags: ["Auth"]
---

# OAuth token endpoint

`POST /api/oauth/token`

## Request

- Base URL: `https://domani.run`
- URL: `https://domani.run/api/oauth/token`
- Auth: HTTP bearer

Exchange an authorization code (with PKCE code_verifier) for an access token, or rotate with grant_type=refresh_token. Access tokens are ordinary domani API tokens carrying the approved scopes and mailbox confinement. Codes are single-use; refresh tokens rotate on every use.

## Response `200`

Token issued

- object
  - `access_token` string
  - `token_type` string
  - `expires_in` integer
  - `refresh_token` string
  - `scope` string

## Other responses

- `400`: invalid_grant / invalid_request (RFC 6749 error body)
- `401`: invalid_client

---

[API](https://skmtc.dev/domani/apis/domani-run-api.md) · [All operations](https://skmtc.dev/domani/apis/domani-run-api/llms.txt) · [OpenAPI document](https://skmtc.dev/domani/apis/domani-run-api/revisions/7679f8159533?raw)