---
title: "Token Endpoint"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# Token Endpoint

`POST /oauth/token`

Exchange a refresh token, JWT assertion, authorization code, or client creds for tokens.

## Request body

- object — Token endpoint request — accepts both JSON and form-encoded (RFC 6749).
  - `assertion` string, nullable
  - `client_id` string, nullable
  - `client_secret` string, nullable
  - `code` string, nullable
  - `code_verifier` string, nullable
  - `grant_type` string, required
  - `redirect_uri` string, nullable
  - `refresh_token` string, nullable

## Response `200`

Successful Response

- TokenResponse — Token endpoint success response.
  - `access_token` string, required
  - `expires_in` integer, required
  - `id_token` string, nullable
  - `refresh_token` string, nullable
  - `token_type` string

## Other responses

- `400` — Bad Request
- `422` — Unprocessable Entity
- `500` — Internal Server Error
- `503` — Service Unavailable

## Changes

- **2026-08-31** `170ab6ea6e23` — 1 info
  - added the media type `application/x-www-form-urlencoded` to the request body
- **2026-07-01** `d65fcba0d25a` — 5 breaking, 1 warning, 28 info
  - request body became required
  - removed the media type `application/x-www-form-urlencoded` from the request body
  - the response's body type/format changed from ``/`` to `object`/`` for status `200`
  - the `detail` response's property type/format changed from `array`/`` to `string`/`` for status `422`
  - …30 more
- **2026-05-07** `5a765d68c56f` — 1 info
  - endpoint added
- **2026-04-13** `76e8f6063728` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/jentic/apis/jentic-control-plane-api/changes/oauth/token/post.md)

---

[API](https://skmtc.dev/jentic/apis/jentic-control-plane-api.md) · [All operations](https://skmtc.dev/jentic/apis/jentic-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/jentic/jentic-control-plane-api/revisions/f4594f50f4d3/schema)