---
title: "The token endpoint: authorization-code and refresh-token grants."
method: POST
path: "/oauth/token"
tags: ["oauth"]
---

# The token endpoint: authorization-code and refresh-token grants.

`POST /oauth/token`

## Request

- Base URL: `https://api.mapmap.ai`
- URL: `https://api.mapmap.ai/oauth/token`
- Auth: none declared

Request bodies are `application/x-www-form-urlencoded` (RFC 6749 §4.1.3
: JSON is not an accepted encoding here and a client sending it gets an
 honest `invalid_request`), and every error body is RFC 6749 shaped.

## Response `200`

Access/refresh pair

- object

## Other responses

- `400`: RFC 6749 error object (`invalid_request`, `invalid_grant`, `invalid_client`, `unsupported_grant_type`); never problem+json

---

[API](https://skmtc.dev/mapmap/apis/sn-gateway.md) · [All operations](https://skmtc.dev/mapmap/apis/sn-gateway/llms.txt) · [OpenAPI document](https://skmtc.dev/mapmap/apis/sn-gateway/revisions/2293be8b4c38?raw)