---
title: "Token"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# Token

`POST /oauth/token`

## Request

- Base URL: `https://api.muapi.ai`
- URL: `https://api.muapi.ai/oauth/token`
- Auth: one of:
  - API key in header `x-api-key`
  - OAuth 2 (client credentials, token URL `https://api.muapi.ai/oauth/token`)

OAuth 2.0 token endpoint. Supports:
- client_credentials: a user's own machine credential (see /oauth/clients).
- authorization_code (+ PKCE): redeems a code from GET/POST /oauth/authorize.
- refresh_token: mints a new access token for an authorization_code grant
  without repeating consent.
Client auth accepts client_secret_post (form) or client_secret_basic
(Authorization header) for confidential clients, per RFC 6749 §2.3.1; a
public client (token_endpoint_auth_method="none") sends neither and relies
on PKCE instead.

## Headers

- `authorization` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/muapi/apis/muapi-api.md) · [All operations](https://skmtc.dev/muapi/apis/muapi-api/llms.txt) · [OpenAPI document](https://skmtc.dev/muapi/apis/muapi-api/revisions/e4b7374381e5?raw)