---
title: "OAuth 2.0 token endpoint (authorization_code + PKCE, refresh_token)."
method: POST
path: "/api/oauth/org/{orgToken}/token"
tags: ["OAuth"]
---

# OAuth 2.0 token endpoint (authorization_code + PKCE, refresh_token).

`POST /api/oauth/org/{orgToken}/token`

## Request

- Base URL: `https://api.mobilecoach.org` (the document declares no server; this is the origin it was published from)
- URL: `https://api.mobilecoach.org/api/oauth/org/{orgToken}/token`
- Auth: none declared

## Path parameters

- `orgToken` string, required

## Request body `application/x-www-form-urlencoded`

- object
  - `grant_type` string
  - `client_id` string
  - `code` string
  - `code_verifier` string
  - `redirect_uri` string
  - `refresh_token` string

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `500`: Internal server error

## Changes

- **2026-09-02** `870f28ba2607`: 5 info
  - added the optional property `error/errorId` to the response with the `400` status
  - added the optional property `error/errorId` to the response with the `401` status
  - added the optional property `error/errorId` to the response with the `403` status
  - added the optional property `error/errorId` to the response with the `404` status
  - …1 more

[Operation history](https://skmtc.dev/mobilecoach/apis/mobilecoach-api/changes/api/oauth/org/:orgToken/token/post.md)

---

[API](https://skmtc.dev/mobilecoach/apis/mobilecoach-api.md) - [All operations](https://skmtc.dev/mobilecoach/apis/mobilecoach-api/llms.txt) - [OpenAPI document](https://skmtc.dev/mobilecoach/apis/mobilecoach-api/revisions/df463b248fcb?raw)