---
title: "Create Access Token"
method: POST
path: "/auth/token"
tags: ["Management"]
---

# Create Access Token

`POST /auth/token`

Exchange the authorization code for an access token

## Headers

- `Finch-API-Version` string, date, required
- `Content-Type` string, required

## Request body

- CreateAccessTokenRequest
  - `client_id` string, uuid — The client ID for your application
  - `client_secret` string — The client secret for your application
  - `code` string, required — The authorization code received from the authorization server
  - `redirect_uri` string — The redirect URI used in the authorization request (optional)

## Response `200`

Access Token

- CreateAccessTokenResponse
  - `access_token` string, required — The access token for the connection
  - `token_type` string, required — The RFC 8693 token type (Finch uses `bearer` tokens)
  - `connection_id` string, required — The Finch UUID of the connection associated with the `access_token`
  - `customer_id` string, nullable — The ID of your customer you provided to Finch when a connect session was created for this connection
  - `customer_name` string, nullable — The name of your customer you provided to Finch when a connect session was created for this connection
  - `account_id` string — [DEPRECATED] Use `connection_id` to identify the connection instead of this account ID
  - `client_type` 'development' | 'production' | 'sandbox', required — The type of application associated with a token.
  - `company_id` string — The Finch UUID of the company associated with the `access_token`.
  - `connection_type` 'finch' | 'provider', required — The type of the connection associated with the token. - `provider` - connection to an external provider - `finch` - finch-generated data.
  - `products` string[], required — An array of the authorized products associated with the `access_token`
  - `provider_id` string, required — The ID of the provider associated with the `access_token`
  - `entity_ids` string[], required — An array of entity IDs that can be accessed with this access token

## Changes

> 53 revisions in range; 2 could not be searched.

- **2026-07-15** `4ffde1b7d987` — 1 info
  - response property `company_id` reactivated
- **2026-03-10** `093ade6f1d31` — 1 info
  - added the optional property `customer_name` to the response with the `200` status
- **2025-10-27** `0105d239fcaf` — 3 info
  - the request property `client_id` became optional
  - the request property `client_secret` became optional
  - added the required property `entity_ids` to the response with the `200` status
- **2025-08-21** `6d0c6a1feba5` — 4 breaking, 1 info
  - the request property `client_id` became required
  - the request property `client_secret` became required
  - the response property `account_id` became optional for the status `200`
  - the response property `company_id` became optional for the status `200`
  - …1 more

[Change history](https://skmtc.dev/finch-api/apis/api-reference/changes/auth/token/post.md)

---

[API](https://skmtc.dev/finch-api/apis/api-reference.md) · [All operations](https://skmtc.dev/finch-api/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/finch-api/api-reference/revisions/f1cca2cb0ef2/schema)