---
title: "Token"
method: POST
path: "/oauth/token"
---

# Token

`POST /oauth/token`

## Request

- Base URL: `https://api.mesharc.dev` (the document declares no server; this is the origin it was published from)
- URL: `https://api.mesharc.dev/oauth/token`
- Auth: none declared

Both grants. The body is form-encoded, as the RFC says, and JSON is
accepted too because some clients send it.

Every answer is built here rather than returned as a dict, so the no-store
headers are on the response itself. Relying on an injected `Response` put
them on failures and missed every success -- the one case where the body
actually is a credential.

Async only to read the body (_body); the rest -- Mongo, and the .env
config() reads -- runs on a worker thread, not on the loop every other
request shares.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/mesharc/apis/mesharc-api.md) · [All operations](https://skmtc.dev/mesharc/apis/mesharc-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mesharc/apis/mesharc-api/revisions/d63cc02dfec2?raw)