---
title: "OAuth 2.0 token endpoint"
method: POST
path: "/oauth/token"
tags: ["auth"]
---

# OAuth 2.0 token endpoint

`POST /oauth/token`

## Request

- Base URL: `/api/v1` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/v1/oauth/token`
- Auth: none declared

Exchanges an authorization code for an access token, or a refresh token for a new one. Part of the OAuth 2.0 Authorization Code flow with PKCE. Needs no authentication: the grant itself is the credential.

## Request body

- Oauth2serverTokenRequest
  - `client_id` string
  - `code` string
  - `code_verifier` string
  - `grant_type` string
  - `redirect_uri` string
  - `refresh_token` string

## Response `200`

The access token, its type, lifetime and refresh token.

- Oauth2serverTokenResponse
  - `access_token` string
  - `expires_in` integer
  - `refresh_token` string
  - `token_type` string

## Other responses

- `400`: Unsupported grant type, or an invalid, expired or already-used authorization code.
- `401`: Invalid or expired refresh token.
- `500`: Internal server error.

## Changes

- **2026-09-10** `0cee97c2eb8e`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/go-vikunja/apis/vikunja-api/changes/oauth/token/post.md)

---

[API](https://skmtc.dev/go-vikunja/apis/vikunja-api.md) - [All operations](https://skmtc.dev/go-vikunja/apis/vikunja-api/llms.txt) - [OpenAPI document](https://skmtc.dev/go-vikunja/apis/vikunja-api/revisions/12ae97e7e29c?raw)