---
title: "Token endpoint"
method: POST
path: "/api/oauth/token"
tags: ["OAuth"]
---

# Token endpoint

`POST /api/oauth/token`

## Request

- Base URL: `https://makefx.app`
- URL: `https://makefx.app/api/oauth/token`
- Auth: none declared

Exchanges an authorization code, or a refresh token, for tokens. Form-encoded as RFC 6749 requires; JSON is accepted too.

## Headers

- `API-Version` '2026-09-10'

## Request body

- union
  - object
    - `grant_type` 'authorization_code', required
    - `code` string, required
    - `code_verifier` string, required
    - `redirect_uri` string, uri, required
    - `client_id` string
    - `client_secret` string
    - `resource` string, uri
  - object
    - `grant_type` 'refresh_token', required
    - `refresh_token` string, required
    - `scope` string
    - `client_id` string
    - `client_secret` string
    - `resource` string, uri

## Response `200`

Success

- object
  - `access_token` string, required
  - `token_type` string, required
  - `expires_in` number, required
  - `scope` string, required
  - `refresh_token` string
  - `refresh_token_expires_in` number
  - `user` object, nullable, required
    - `id` number, required
    - `email` string, email
    - `name` string

## Other responses

- `400`: The request did not match the schema
- `401`: invalid_client: the client credentials were missing or wrong
- `404`: Not found
- `429`: Rate limited. RateLimit names the policy; Retry-After says when to try again
- `500`: Internal server error

---

[API](https://skmtc.dev/makefx/apis/makefx-app-api.md) · [All operations](https://skmtc.dev/makefx/apis/makefx-app-api/llms.txt) · [OpenAPI document](https://skmtc.dev/makefx/apis/makefx-app-api/revisions/a05584da31c6?raw)