---
title: "OAuth 2.1 Token endpoint"
method: POST
path: "/oauth/token"
tags: ["oauth-server"]
---

# OAuth 2.1 Token endpoint

`POST /oauth/token`

Issues access tokens in exchange for authorization codes or refresh tokens. Supports authorization_code and refresh_token grant types. Only available when OAuth server is enabled (set `GOTRUE_OAUTH_SERVER_ENABLED=true` for self-hosted or enable in Supabase Dashboard).

## Response `200`

Access token issued successfully

- object
  - `access_token` string — The access token
  - `token_type` string — Type of token issued
  - `expires_in` integer — Lifetime in seconds of the access token
  - `refresh_token` string — Refresh token (if applicable)
  - `scope` string — Authorized scopes

## Other responses

- `400` — HTTP Bad Request response. Can occur if the passed in JSON cannot be unmarshalled properly or when CAPTCHA verification was not successful. In certain cases can also occur when features are disabled on the server (e.g. sign ups). It may also mean that the operation failed due to some constraint not being met (such a user already exists for example).
- `401` — HTTP Unauthorized response.

## Changes

- **2025-09-22** `f782805361ed` — 1 info
  - endpoint added
- **2023-02-01** `144a34ca6d74` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/changes/oauth/token/post.md)

---

[API](https://skmtc.dev/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/revisions/2e2a74a7459f/schema)