SUsupabase
oauth-server

OAuth 2.1 Token endpoint

Changed on

Issues access tokens in exchange for authorization codes or refresh tokens. Supports authorization_code and refresh_token grant types. Only available when OAuth server is enabled (set GOTRUE_OAUTH_SERVER_ENABLED=true for self-hosted or enable in Supabase Dashboard).

post/oauth/token

Request

  • Base URL
    https://abcdefghijklmnopqrst.supabase.co/auth/v1
  • URL
    https://abcdefghijklmnopqrst.supabase.co/auth/v1/oauth/token
  • Auth
    none declared

Request body application/x-www-form-urlencoded

grant_type'authorization_code' | 'refresh_token' required

The grant type being used

codestring

Authorization code (required for authorization_code grant)

redirect_uristring uri

Redirect URI (required for authorization_code grant)

code_verifierstring

PKCE code verifier (required for authorization_code grant)

refresh_tokenstring

Refresh token (required for refresh_token grant)

client_idstring

OAuth client identifier

client_secretstring

OAuth client secret (for confidential clients)

Response

Access token issued successfully

access_tokenstring

The access token

token_typestring

Type of token issued

expires_ininteger

Lifetime in seconds of the access token

refresh_tokenstring

Refresh token (if applicable)

scopestring

Authorized scopes

Example response

{
  "token_type": "Bearer"
}

Changes