---
title: "Token endpoint"
method: POST
path: "/oauth2/token"
tags: ["agent-auth"]
---

# Token endpoint

`POST /oauth2/token`

## Request

- Base URL: `https://api.letsship.ai/v1`
- URL: `https://api.letsship.ai/v1/oauth2/token`
- Auth: none declared

authorization_code with PKCE, and refresh_token with rotation, for clients that sign a person in through the console. RFC 7523 jwt-bearer: trade an identity_assertion for a one-hour access token. urn:workos:agent-auth:grant-type:claim: poll a claim (RFC 8628 vocabulary). `resource` (RFC 8707) binds the token to the API (default) or the MCP server.

## Response `200`

An access token. Never cached.

- OAuthTokenResponse
  - `access_token` string, required
  - `token_type` 'Bearer', required
  - `expires_in` integer, required
  - `scope` string, required
  - `refresh_token` string
  - `identity_assertion` string
  - `assertion_expires` string

## Other responses

- `400`: RFC 6749 section 5.2 error.
- `500`: server_error: this environment is not configured.

---

[API](https://skmtc.dev/letsship/apis/ship-api.md) · [All operations](https://skmtc.dev/letsship/apis/ship-api/llms.txt) · [OpenAPI document](https://skmtc.dev/letsship/apis/ship-api/revisions/e6eac1bcadd4?raw)