---
title: "Exchange Grant for Tokens"
method: POST
path: "/oauth/token"
tags: ["OAuth Token"]
---

# Exchange Grant for Tokens

`POST /oauth/token`

## Request

- Base URL: `https://login.flocksafety.com`
- URL: `https://login.flocksafety.com/oauth/token`
- Auth: none declared

Exchanges an OAuth grant for tokens. Use authorization_code to exchange an authorization code,
or refresh_token to obtain new tokens.

## Request body `application/x-www-form-urlencoded`

- union
  - AuthorizationCode
    - `grant_type` 'authorization_code', required: Denotes the flow you are using. For Authorization Code, use authorization_code.
    - `client_id` string, required: Your application's Client ID.
    - `client_secret` string, required: Your application's Client Secret.
    - `code` string, required: The Authorization Code received from the initial /authorize call.
    - `redirect_uri` string, uri: This is required only if it was set at the GET /authorize endpoint. The values must match.
  - RefreshToken
    - `grant_type` 'refresh_token', required: Denotes the flow you are using. To refresh a token, use refresh_token.
    - `client_id` string, required: Your application's Client ID.
    - `client_secret` string: Your application's Client Secret. Required when the Token Endpoint Authentication Method field at your Application Settings is Post or Basic.
    - `refresh_token` string, required: The Refresh Token to use.
    - `scope` string: A space-delimited list of requested scope permissions. If not sent, the original scopes will be used; otherwise you can request a reduced set of scopes. Note that this must be URL encoded.

## Response `200`

Successful response.

- object
  - `access_token` string
  - `refresh_token` string
  - `id_token` string
  - `token_type` string
  - `expires_in` integer
  - `recovery_code` string
  - `error` string
  - `error_description` string

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: User has yet to authorize device code or transaction failed
- `404`: Not Found
- `405`: Method Not Allowed
- `429`: You are polling faster than the specified interval of 5 seconds
- `500`: Internal Server Error
- `501`: Not Implemented
- `503`: Service Unavailable

---

[API](https://skmtc.dev/flocksafety/apis/user-oauth-api.md) - [All operations](https://skmtc.dev/flocksafety/apis/user-oauth-api/llms.txt) - [OpenAPI document](https://skmtc.dev/flocksafety/apis/user-oauth-api/revisions/51b9b3fdf96d?raw)