---
title: "Token endpoint"
method: POST
path: "/api/auth/oauth2/token"
tags: ["oauth"]
---

# Token endpoint

`POST /api/auth/oauth2/token`

Exchange an authorization code (with PKCE code_verifier) or a refresh token for an access token.

## Response `200`

Standard OAuth token envelope.

- TokenResponse
  - `access_token` string, required
  - `token_type` string, required
  - `expires_in` integer — Access token lifetime in seconds (3600).
  - `refresh_token` string
  - `scope` string
  - `id_token` string

## Other responses

- `400` — OAuth error envelope (invalid_grant, invalid_client, ...).

---

[API](https://skmtc.dev/superset/apis/superset-api.md) · [All operations](https://skmtc.dev/superset/apis/superset-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/superset/superset-api/revisions/dee6e20fae0d/schema)