---
title: "Generate tokens"
method: POST
path: "/oauth/tokens"
tags: ["OAuth2"]
---

# Generate tokens

`POST /oauth/tokens`

Exchange authorization code for access token or refresh an existing token.

## Request body

- union
  - object
    - `client_id` string, required — Application's client ID.
    - `client_secret` string — Application's client secret.
    - `resource` string — The canonical URI of the resource server (RFC 8707). For MCP clients, this should be the MCP server endpoint URL. Example: https://api.hyperline.co/mcp
    - `grant_type` 'authorization_code', required — To exchange an auth code for an app access token, use `authorization_code`.
    - `code` string, required — The auth code received when creating the authorization.
    - `redirect_uri` string, required — Must match the value set at the `GET /authorize` endpoint.
    - `code_verifier` string — PKCE code verifier (RFC 7636). The original random string used to generate the code_challenge sent during authorization. Required when code_challenge was used.
  - object
    - `client_id` string, required — Application's client ID.
    - `client_secret` string — Application's client secret.
    - `resource` string — The canonical URI of the resource server (RFC 8707). For MCP clients, this should be the MCP server endpoint URL. Example: https://api.hyperline.co/mcp
    - `grant_type` 'refresh_token', required — To renew an app access token with a refresh token, use `refresh_token`.
    - `refresh_token` string, required — The refresh token received when creating the authorization.

## Response `200`

- object
  - `access_token` string, required — Access token with which you will be able to access the Hyperline API on the organisation's behalf.
  - `refresh_token` string — Refresh token with which you will be able to retrieve a new access token on this endpoint. The refresh token does not expire.
  - `expires_in` number, required — The number of seconds left before the app access token expires. Be sure to renew your app access token before this reaches zero.
  - `token_type` 'bearer', required

---

[API](https://skmtc.dev/hyperline/apis/hyperline-api.md) · [All operations](https://skmtc.dev/hyperline/apis/hyperline-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/hyperline/hyperline-api/revisions/19fa5f22e39b/schema)