---
title: "Generate tokens"
method: POST
path: "/oauth2/tokens"
tags: ["OAuth API"]
---

# Generate tokens

`POST /oauth2/tokens`

## Request

- Base URL: `https://api.mollie.com`
- URL: `https://api.mollie.com/oauth2/tokens`
- Auth: HTTP basic

Exchange the authorization code you received from the [Authorize endpoint](oauth-authorize) for an 'access token' API credential, with which you can communicate with the Mollie API on behalf of the consenting merchant.

This endpoint can only be accessed using **OAuth client credentials**.

> 🔑 Access with
>
> [Basic authentication](/reference/authentication)

## Headers

- `Authorization` string, required
- `Content-Type` string

## Request body

- object
  - `grant_type` string, required: If you wish to exchange your authorization code for an app access token, use grant type `authorization_code`. If you wish to renew your app access token with your refresh token, use grant type `refresh_token`. Possible values: `authorization_code` `refresh_token`
  - `code` string: The authorization code you received when creating the authorization. Only use this field when using grant type `authorization_code`.
  - `refresh_token` string: The refresh token you received when creating the authorization. Only use this field when using grant type `refresh_token`.
  - `redirect_uri` string: The URL the merchant is sent back to once the request has been authorized. It must match the URL you set when registering your app.

## Response `200`

The newly generated access token and refresh token.

- object
  - `access_token` string: The app access token, with which you will be able to access the Mollie API on the merchant's behalf.
  - `refresh_token` string: The refresh token, with which you will be able to retrieve new app access tokens on this endpoint. The refresh token does not expire.
  - `expires_in` integer: The number of seconds left before the app access token expires. Be sure to renew your app access token before this reaches zero.
  - `token_type` string: As per OAuth standards, the provided app access token can only be used with `bearer` authentication. Possible values: `bearer`
  - `scope` string: A space-separated list of [permissions](https://docs.mollie.com/docs/permissions).

## Other responses

- `429`: Rate Limit has been reached.

---

[API](https://skmtc.dev/mollie/apis/mollie-connect.md) - [All operations](https://skmtc.dev/mollie/apis/mollie-connect/llms.txt) - [OpenAPI document](https://skmtc.dev/mollie/apis/mollie-connect/revisions/65271e79a786?raw)