---
title: "Obtain an access token"
method: POST
path: "/oauth2/token"
tags: ["OAuth2"]
---

# Obtain an access token

`POST /oauth2/token`

## Request

- Base URL: `https://oauth2.mercury.com`
- URL: `https://oauth2.mercury.com/oauth2/token`
- Auth: HTTP basic

Exchange an authorization code for an access token

## Request body `application/x-www-form-urlencoded`

- OAuth2TokenRequest
  - `code` string, required: The authorization code received from the authorization server. Required when grant_type is "authorization_code".
  - `code_verifier` string, required: Required for clients with PKCE flow when using authorization code. Use together with \`grant_type=authorization_code\`. This is the value whose hash was sent as \`code_challenge\` when starting the flow.
  - `grant_type` 'authorization_code' | 'refresh_token', required: The grant type for the token request. Must be "authorization_code" for the authorization code flow or "refresh_token" when refreshing an access token.
  - `redirect_uri` string, required: The redirect URI that was used in the authorization request. Required when grant_type is \`authorization_code\`.
  - `refresh_token` string, required: The refresh token from the last grant if the \`offline_access\` scope was included. Use together with \`grant_type=refresh_token\`.
  - `scope` string, required: A space-separated list of the scopes requested for the access token. Required when grant_type is \`refresh_token\`. Must be a subset of the scopes granted during the original authorization.

## Response `200`

- OAuth2TokenResponse
  - `access_token` string, required: The access token issued by the authorization server.
  - `expires_in` integer: The lifetime in seconds of the access token. For example, the value "3600" denotes that the access token will expire in one hour from the time the response was generated.
  - `refresh_token` string: The refresh token, which can be used to obtain new access tokens using the same authorization grant.
  - `scope` string: The scope of the access token. A space-separated list of scopes.
  - `token_type` string, required: The type of the token issued. Value is case insensitive and should be "Bearer".

## Other responses

- `400`: Invalid `body`

---

[API](https://skmtc.dev/mercurytechnologies/apis/mercury-oauth2-api.md) - [All operations](https://skmtc.dev/mercurytechnologies/apis/mercury-oauth2-api/llms.txt) - [OpenAPI document](https://skmtc.dev/mercurytechnologies/apis/mercury-oauth2-api/revisions/e870b77c0891?raw)