---
title: "Access token endpoint"
method: POST
path: "/token"
tags: ["Integrated Authorization Server"]
---

# Access token endpoint

`POST /token`

Issues an access token based on an authorization request, in case the integrated authorization server is enabled

## Request body

- AccessTokenRequest — Request for obtaining an access token
  - `client_id` string — Unique identifier for the client making the request
  - `code` string — Authorization code received from the authorization server
  - `code_verifier` string — Code verifier used in the PKCE flow
  - `grant_type` 'authorization_code' | 'urn:ietf:params:oauth:grant-type:pre-authorized_code' | 'password', required — OAuth 2.0 grant type
  - `pre-authorized_code` string — Pre-authorized code used for credential issuance
  - `redirect_uri` string — The redirect URI where the response should be sent
  - `scope` string — The scope of access requested by the client
  - `user_pin` string — PIN required for pre-authorized flows (if applicable)
  - `tx_code` string — Transaction code for authorization (if applicable)

## Response `200`

Successful response

- AccessTokenResponse
  - `access_token` string, required — The issued access token
  - `scope` string — The granted scope(s) of the access token
  - `token_type` string, required — The type of token issued (typically "Bearer")
  - `expires_in` number — The duration in seconds for which the token is valid
  - `authorization_pending` boolean — Indicates if authorization is still pending
  - `interval` number — The recommended polling interval in seconds
  - `authorization_details` AuthorizationDetails[] — Authorization details with credential identifiers (v1.0.15)
    - `type` 'openid_credential', required
    - `credential_configuration_id` string
    - `credential_identifiers` string[] — Array of credential identifiers that can be issued
    - `locations` string[]

## Changes

- **2025-09-30** `bc177bfc5928` — 2 warning, 2 info
  - removed the optional property `c_nonce` from the response with the `200` status
  - removed the optional property `c_nonce_expires_in` from the response with the `200` status
  - added the optional property `authorization_details` to the response with the `200` status
  - the response property `token_type` became required for the status `200`

[Change history](https://skmtc.dev/sphereon-opensource/apis/sphereon-oid4vci-api/changes/token/post.md)

---

[API](https://skmtc.dev/sphereon-opensource/apis/sphereon-oid4vci-api.md) · [All operations](https://skmtc.dev/sphereon-opensource/apis/sphereon-oid4vci-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/sphereon-opensource/sphereon-oid4vci-api/revisions/bc177bfc5928/schema)