---
title: "OAuth 2.1 token endpoint"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# OAuth 2.1 token endpoint

`POST /oauth/token`

Exchanges an authorization code (with PKCE) for an access + refresh token, or rotates a refresh token. Accepts client credentials in the form body (`client_secret_post` / `none`) or in the Authorization header (Bearer registration token, or Basic auth).

## Request body

- union
  - object
    - `grant_type` 'authorization_code', required
    - `client_id` string
    - `code` string, required
    - `redirect_uri` string, uri, required
    - `code_verifier` string, required
  - object
    - `grant_type` 'refresh_token', required
    - `client_id` string
    - `refresh_token` string, required
    - `scope` string, nullable

## Response `200`

Default Response

- object
  - `access_token` string, required
  - `token_type` 'Bearer', required
  - `expires_in` number, required
  - `refresh_token` string
  - `scope` string

## Other responses

- `400` — Default Response
- `401` — Default Response
- `500` — Default Response

---

[API](https://skmtc.dev/jam/apis/jam-public-api.md) · [All operations](https://skmtc.dev/jam/apis/jam-public-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/jam/jam-public-api/revisions/b628e9368a59/schema)