---
title: "Create a token"
method: POST
path: "/oauth/token"
tags: ["Authentication"]
---

# Create a token

`POST /oauth/token`

Retrieve a token

## Request body

- object
  - `grant_type` 'authorization_code' | 'refresh_token' | 'client_credentials', required — The OAuth 2.0 grant type being used for the token request
  - `code` string — The authorization code received from the authorization server (required for authorization_code grant type)
  - `refresh_token` string — The refresh token used to obtain a new access token (required for refresh_token grant type)
  - `client_id` string — The client identifier issued to the client during registration (required for public clients, when not authenticating via Basic Auth)
  - `scope` string
  - `code_verifier` string — PKCE code verifier used to verify the authorization request (required when PKCE was used in authorization request)

## Response `200`

Retrieve the quote details

- object
  - `access_token` string, required — The access token to access the API endpoints
  - `token_type` 'Bearer', required — The type of token issued, always 'Bearer'
  - `expires_in` number, required — The lifetime of the access token in seconds (60 minutes)
  - `refresh_token` string, required — The refresh token to create a new access_token
  - `scope` string, required — Space-delimited list of scopes granted on this token (RFC 6749).

## Other responses

- `400` — The server cannot or will not process the request due to something that is perceived to be a client error (e.g., malformed request syntax, invalid request message framing, or deceptive request routing).
- `401` — The client must authenticate itself to get the requested response.
- `402` — A higher pricing plan is required to access the resource.
- `403` — The client does not have the necessary permissions to access the resource.
- `404` — The server can't find the requested resource.
- `405` — The request method is not allowed.
- `409` — The request could not be completed due to a conflict mainly due to unique constraints.
- `422` — The request was well-formed but was unable to be followed due to semantic errors.
- `429` — The client has sent too many requests.
- `500` — The server has encountered a situation it doesn't know how to handle.

---

[API](https://skmtc.dev/nomos/apis/nomos-api.md) · [All operations](https://skmtc.dev/nomos/apis/nomos-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/nomos/nomos-api/revisions/da60ad83e92f/schema)