---
title: "OAuth token endpoint"
method: POST
path: "/oauth/token"
tags: ["auth"]
---

# OAuth token endpoint

`POST /oauth/token`

Handles authorization_code grants (with PKCE) and token exchange (RFC 8693).
For token-exchange, supported subject_token_type values are
urn:ietf:params:oauth:token-type:id_token and urn:ietf:params:oauth:token-type:access_token.

## Response `200`

OK

- TokenExchangeResponse
  - `access_token` string
  - `expires_in` integer
  - `issued_token_type` string
  - `token_type` string

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `500` — Internal Server Error

## Changes

> 56 revisions in range; 1 not diffed.

- **2026-04-29** `f0c42d18589e` — 1 info
  - endpoint added
- **2025-06-02** `0c070796939d` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/marmotdata/apis/marmot-api/changes/oauth/token/post.md)

---

[API](https://skmtc.dev/marmotdata/apis/marmot-api.md) · [All operations](https://skmtc.dev/marmotdata/apis/marmot-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/marmotdata/marmot-api/revisions/0bd802afff21/schema)