---
title: "Request an Access Token"
method: POST
path: "/oauth/v2/token"
tags: ["OAuth 2.0"]
---

# Request an Access Token

`POST /oauth/v2/token`

## Request

- Base URL: `https://api.proof.com`
- URL: `https://api.proof.com/oauth/v2/token`
- Auth: none declared

Issues an [access token](https://datatracker.ietf.org/doc/html/rfc6749#section-1.4) from the [token endpoint](https://datatracker.ietf.org/doc/html/rfc6749#section-3.2). Client authentication uses [`client_secret_post`](https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1), [`client_secret_basic`](https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1) or [`private_key_jwt`](https://datatracker.ietf.org/doc/html/rfc7523#section-2.2). `GET /.well-known/oauth-authorization-server` lists the supported grant types.

## Request body `application/x-www-form-urlencoded`

- union
  - ClientCredentialsTokenRequest
    - `grant_type` 'client_credentials', required: The [Client Credentials grant](https://datatracker.ietf.org/doc/html/rfc6749#section-4.4).
    - `scope` string: Space-separated [scope](https://datatracker.ietf.org/doc/html/rfc6749#section-3.3) values. `read` and `write` are accepted.
    - `client_id` string: Your [`client_id`](https://datatracker.ietf.org/doc/html/rfc6749#section-2.2).
    - `client_secret` string: Your client secret, for [`client_secret_post`](https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1) client authentication.
    - `client_assertion_type` 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer': Set to `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` for [`private_key_jwt`](https://datatracker.ietf.org/doc/html/rfc7523#section-2.2) client authentication.
    - `client_assertion` string: A JWT signed with one of your registered keys, for [`private_key_jwt`](https://datatracker.ietf.org/doc/html/rfc7523#section-2.2) client authentication: `iss` and `sub` are your `client_id`, `aud` is the issuer or the token endpoint URL, with `exp` and a single-use `jti`.
  - AuthorizationCodeTokenRequest
    - `grant_type` 'authorization_code', required: The [Authorization Code grant](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1).
    - `code` string, required: The [authorization code](https://datatracker.ietf.org/doc/html/rfc6749#section-1.3.1) returned to your `redirect_uri`. Valid for 10 minutes and a single exchange.
    - `redirect_uri` string, required: The `redirect_uri` from the authorization request.
    - `code_verifier` string: The [PKCE code verifier](https://datatracker.ietf.org/doc/html/rfc7636#section-4.1) matching the `code_challenge` sent to the authorization endpoint.
    - `client_id` string: Your [`client_id`](https://datatracker.ietf.org/doc/html/rfc6749#section-2.2).
    - `client_secret` string: Your client secret, for [`client_secret_post`](https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1) client authentication.
    - `client_assertion_type` 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer': Set to `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` for [`private_key_jwt`](https://datatracker.ietf.org/doc/html/rfc7523#section-2.2) client authentication.
    - `client_assertion` string: A JWT signed with one of your registered keys, for [`private_key_jwt`](https://datatracker.ietf.org/doc/html/rfc7523#section-2.2) client authentication: `iss` and `sub` are your `client_id`, `aud` is the issuer or the token endpoint URL, with `exp` and a single-use `jti`.
  - RefreshTokenTokenRequest
    - `grant_type` 'refresh_token', required: The [Refresh Token grant](https://datatracker.ietf.org/doc/html/rfc6749#section-6).
    - `refresh_token` string, required: The [refresh token](https://datatracker.ietf.org/doc/html/rfc6749#section-1.5) issued with a previous access token.
    - `client_id` string: Your [`client_id`](https://datatracker.ietf.org/doc/html/rfc6749#section-2.2).
    - `client_secret` string: Your client secret, for [`client_secret_post`](https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1) client authentication.
    - `client_assertion_type` 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer': Set to `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` for [`private_key_jwt`](https://datatracker.ietf.org/doc/html/rfc7523#section-2.2) client authentication.
    - `client_assertion` string: A JWT signed with one of your registered keys, for [`private_key_jwt`](https://datatracker.ietf.org/doc/html/rfc7523#section-2.2) client authentication: `iss` and `sub` are your `client_id`, `aud` is the issuer or the token endpoint URL, with `exp` and a single-use `jti`.

## Response `200`

successful

- TokenResponse
  - `access_token` string: The issued [access token](https://datatracker.ietf.org/doc/html/rfc6749#section-1.4).
  - `token_type` string: Always `Bearer`. See [Bearer token usage](https://datatracker.ietf.org/doc/html/rfc6750#section-2.1).
  - `expires_in` integer: Access token lifetime, in seconds.
  - `scope` string: Space-separated [scope](https://datatracker.ietf.org/doc/html/rfc6749#section-3.3) values granted to the access token.
  - `created_at` integer: Issue time, as a Unix timestamp in seconds.
  - `refresh_token` string: A [refresh token](https://datatracker.ietf.org/doc/html/rfc6749#section-1.5), for grants that support refreshing.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized

---

[API](https://skmtc.dev/proof/apis/oauth-2-0-api-specification.md) - [All operations](https://skmtc.dev/proof/apis/oauth-2-0-api-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/proof/apis/oauth-2-0-api-specification/revisions/7e769f9c96ed?raw)