---
title: "Token endpoint"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# Token endpoint

`POST /oauth/token`

## Request

- Base URL: `https://everypage.co`
- URL: `https://everypage.co/oauth/token`
- Auth: none required

Exchanges an authorization code (with the PKCE `code_verifier`) or a refresh token for tokens. Client auth via HTTP Basic or body params; confidential clients must present `client_secret`. Refresh tokens rotate: each refresh returns a new `refresh_token` and retires the previous one (replaying a retired token revokes the whole family); pass `scope` to down-scope. Errors are RFC 6749 JSON documents.

## Response `200`

Token response

- object
  - `access_token` string
  - `token_type` string
  - `expires_in` integer
  - `refresh_token` string
  - `scope` string

## Other responses

- `400`: `invalid_request`, `invalid_grant` (unknown, used, expired or PKCE-mismatched code; revoked or rotated refresh token) or `unsupported_grant_type`.
- `401`: `invalid_client` - unknown `client_id`, or a wrong or missing `client_secret` for a confidential client.

---

[API](https://skmtc.dev/everypage/apis/everypage-api.md) · [All operations](https://skmtc.dev/everypage/apis/everypage-api/llms.txt) · [OpenAPI document](https://skmtc.dev/everypage/apis/everypage-api/revisions/e6674f903456?raw)