---
title: "Exchange an authorization code, or refresh, for a bearer token"
method: POST
path: "/api/oauth2/token"
tags: ["OAuth"]
---

# Exchange an authorization code, or refresh, for a bearer token

`POST /api/oauth2/token`

## Request

- Base URL: `https://saltapp.ai`
- URL: `https://saltapp.ai/api/oauth2/token`
- Auth: none required

grant_type: authorization_code (with code_verifier, PKCE S256) or refresh_token. A public client's PKCE verifier or refresh token IS its credential. A confidential client authenticates on both grants by the method it registered (HTTP Basic, or client_secret in the body) and may omit PKCE unless it sent a code_challenge at authorize. Replaying a used code or refresh token revokes the whole token family.

## Request body

- object
  - `grant_type` 'authorization_code' | 'refresh_token', required
  - `code` string
  - `client_id` string
  - `client_secret` string: Confidential client registered as client_secret_post only.
  - `redirect_uri` string
  - `code_verifier` string
  - `resource` string
  - `refresh_token` string

## Response `200`

OK.

- object
  - `access_token` string: sat_-prefixed.
  - `token_type` 'Bearer'
  - `expires_in` integer
  - `refresh_token` string: srt_-prefixed.
  - `scope` string
  - `resource` string

## Other responses

- `400`: invalid_request / invalid_grant / invalid_target / unsupported_grant_type.
- `401`: invalid_client: client authentication failed.

---

[API](https://skmtc.dev/saltapp/apis/salt-agent-api.md) · [All operations](https://skmtc.dev/saltapp/apis/salt-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/saltapp/apis/salt-agent-api/revisions/a8b8642ab7f8?raw)