---
title: "Exchange a code or refresh token for tokens"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# Exchange a code or refresh token for tokens

`POST /oauth/token`

## Request

- Base URL: `https://api.honkio.ca`
- URL: `https://api.honkio.ca/oauth/token`
- Auth: none required

Form-encoded per RFC 6749. authorization_code needs code, redirect_uri, client_id and code_verifier; refresh_token needs refresh_token and client_id. Refresh tokens rotate on every use; presenting a used one revokes the whole grant. Access tokens live one hour, refresh tokens thirty days. Confidential clients authenticate with HTTP Basic or client_secret in the form.

## Response `200`

Tokens. The access token is presented as a Bearer to the MCP endpoint.

- object: Tokens. The access token is presented as a Bearer to the MCP endpoint.
  - `access_token` string
  - `token_type` string
  - `expires_in` integer
  - `refresh_token` string
  - `scope` string

## Other responses

- `400`: invalid_request, invalid_grant, invalid_scope, invalid_target or unsupported_grant_type.
- `401`: invalid_client.
- `429`: slow_down: 60 requests a minute from one address.

---

[API](https://skmtc.dev/honkio/apis/honkio-api.md) · [All operations](https://skmtc.dev/honkio/apis/honkio-api/llms.txt) · [OpenAPI document](https://skmtc.dev/honkio/apis/honkio-api/revisions/ce4ed3fe9691?raw)