---
title: "Token endpoint (authorization code with PKCE)"
method: POST
path: "/v1/oauth/token/"
tags: ["OAuth"]
---

# Token endpoint (authorization code with PKCE)

`POST /v1/oauth/token/`

## Request

- Base URL: `https://api.educaplay.com`
- URL: `https://api.educaplay.com/v1/oauth/token/`
- Auth: none required

Exchanges the authorization code obtained from `/oauth/authorize/` on the main site for an access token. The code is single use, bound to the `client_id` and `redirect_uri` of the authorization request, and verified against the PKCE `code_verifier`. The access token is a regular Bearer token of this API: it lasts a year, there is no refresh token, and the user can see and revoke it from the application tokens screen of their profile.

## Response `200`

Access token issued.

- OAuthTokenResponse
  - `access_token` string
  - `token_type` string
  - `expires_in` integer: Seconds until the token expires.
  - `scope` string

## Other responses

- `400`: `unsupported_grant_type`, `invalid_grant` (unknown, used or expired code, redirect URI or verifier mismatch) or `invalid_client`.

---

[API](https://skmtc.dev/educaplay/apis/educaplay-api.md) · [All operations](https://skmtc.dev/educaplay/apis/educaplay-api/llms.txt) · [OpenAPI document](https://skmtc.dev/educaplay/apis/educaplay-api/revisions/e31d97013d0d?raw)