---
title: "Exchange a grant for tokens"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# Exchange a grant for tokens

`POST /oauth/token`

## Request

- The document declares no server URL.
- Auth: none declared

Implements the RFC 6749 token endpoint for the authorization_code and refresh_token grants, and the RFC 8628 device_code grant, dispatching on the grant_type form field. No bearer authentication is required.

## Request body `application/x-www-form-urlencoded`

- object
  - `client_id` string
  - `code` string
  - `code_verifier` string
  - `device_code` string
  - `grant_type` 'authorization_code' | 'refresh_token' | 'urn:ietf:params:oauth:grant-type:device_code', required
  - `redirect_uri` string
  - `refresh_token` string

## Response `200`

The issued access token, and a refresh token where the grant issues one.

- object
  - `access_token` string
  - `expires_in` integer
  - `refresh_token` string
  - `token_type` string

## Other responses

- `400`: Invalid grant, code, or client.

## Changes

- **2026-09-28** `d47e9fb78ad0`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/pgedge/apis/pgedge-postgres-mcp-server-api/changes/oauth/token/post.md)

---

[API](https://skmtc.dev/pgedge/apis/pgedge-postgres-mcp-server-api.md) - [All operations](https://skmtc.dev/pgedge/apis/pgedge-postgres-mcp-server-api/llms.txt) - [OpenAPI document](https://skmtc.dev/pgedge/apis/pgedge-postgres-mcp-server-api/revisions/d47e9fb78ad0?raw)