---
title: "Exchange or refresh tokens"
method: POST
path: "/api/oauth/token"
tags: ["OAuth"]
---

# Exchange or refresh tokens

`POST /api/oauth/token`

## Request

- Base URL: `https://app.formaportal.com`
- URL: `https://app.formaportal.com/api/oauth/token`
- Auth: none required

Form-encoded (`application/x-www-form-urlencoded`); JSON is also accepted.
Client credentials may be sent in the body or via HTTP Basic.

`grant_type=authorization_code` requires `code`, `code_verifier` and
`redirect_uri`. `grant_type=refresh_token` requires `refresh_token` — and, for
confidential clients, the client credentials as well.

## Response `200`

Tokens.

- object
  - `access_token` string
  - `token_type` string
  - `expires_in` integer
  - `refresh_token` string
  - `scope` string

## Other responses

- `400`: `invalid_request`, `invalid_grant` (bad, expired or replayed code, or failed PKCE) or `unsupported_grant_type`.
- `401`: `invalid_client` — client authentication failed.

---

[API](https://skmtc.dev/formaportal/apis/formaportal-api.md) · [All operations](https://skmtc.dev/formaportal/apis/formaportal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/formaportal/apis/formaportal-api/revisions/a9412c3b13cb?raw)