---
title: "Token endpoint (RFC 6749 §3.2)"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# Token endpoint (RFC 6749 §3.2)

`POST /oauth/token`

## Request

- Base URL: `https://passport.me`
- URL: `https://passport.me/oauth/token`
- Auth: none required

Exchange an authorization code or refresh token for an access token. PKCE code_verifier required. Refresh tokens rotate on every use; reuse triggers family invalidation (OAuth 2.1 §4.3.1).

## Response `200`

Token issued

- object
  - `access_token` string
  - `token_type` 'Bearer'
  - `expires_in` integer
  - `refresh_token` string
  - `scope` string

## Other responses

- `400`: Invalid request payload.
- `401`: invalid_grant / invalid_client / family revoked.

---

[API](https://skmtc.dev/passport-me/apis/passport-me-api.md) · [All operations](https://skmtc.dev/passport-me/apis/passport-me-api/llms.txt) · [OpenAPI document](https://skmtc.dev/passport-me/apis/passport-me-api/revisions/c0081754a2dc?raw)