---
title: "Creates and renews AccessTokens"
method: POST
path: "/v1/access_tokens"
tags: ["OAuth2"]
---

# Creates and renews AccessTokens

`POST /v1/access_tokens`

This API implements rfc7009, rfc7636 and rfc6749

## Request body

- AccessTokensRequest
  - `grant_type` 'authorization_code' | 'refresh_token' | 'client_credentials', required — Grant Type.
  - `code` string — Authorization code that the client previously received from the authorization server. Required when grant_type is authorization_code.
  - `redirect_uri` string — The redirect URI in the token request must be an exact match of the redirect URI that was used when generating the authorization code. Required for when grant_type is authorization_code.
  - `refresh_token` string — Refresh token that the client previously received from the authorization server. Required when grant_type is refresh_token.
  - `client_id` string, required — Client ID used for authentication.
  - `client_secret` string — Client Secret used for authentication, only used in Server-Side Apps
  - `code_verifier` string — Code verifier(PKCE), only used in Mobile and Native Apps
  - `client_assertion` string — Only used with the combination of client_credentials grant_type and client_assertion_type
  - `client_assertion_type` 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer' — Only used with the combination of client_credentials grant_type and client_assertion

## Response `200`

Success

- AccessTokensReponse — Access Tokens
  - `validity_start_date` string — Date and Time in ISO8601 format example: '2018-11-06T10:20:37.094533Z'
  - `validity_end_date` string — Date and Time in ISO8601 format example: '2018-11-06T10:20:37.094533Z'
  - `token_type` string, required — Token type
  - `scope` string — List of scopes
  - `refresh_token` string — Refresh token should be used after the access token is expired to fetch a new access token
  - `expires_in` integer, required — Expiration time in seconds
  - `authorization_id` string — Authorization Id could be used later on in authorization_changed Webhook
  - `access_token` string, required — Access token
  - `status` 'pending' | 'approved' — In BMW and MINI case, the status is pending until the car owner grants access in BMW ConnectedDrive Portal

## Other responses

- `400` — Error
- `500` — Server Errors

---

[API](https://skmtc.dev/high-mobility/apis/oauth2-api.md) · [All operations](https://skmtc.dev/high-mobility/apis/oauth2-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/high-mobility/oauth2-api/revisions/656dd06678e9/schema)