---
title: "Token endpoint"
method: POST
path: "/oauth2/token"
tags: ["agent-auth"]
---

# Token endpoint

`POST /oauth2/token`

## Request

- Base URL: `https://www.supersetapp.com`
- URL: `https://www.supersetapp.com/oauth2/token`
- Auth: none required

Exchanges an authorization code, a refresh token, or an RFC 7523 assertion for an access token. Supported grants are published in `/.well-known/oauth-authorization-server`.

## Request body `application/x-www-form-urlencoded`

- TokenRequest: An OAuth token request.
  - `grant_type` 'authorization_code' | 'refresh_token' | 'urn:ietf:params:oauth:grant-type:jwt-bearer' | 'urn:workos:agent-auth:grant-type:claim', required: One of the grants in the AS metadata.
  - `code` string: Authorization code, for that grant.
  - `code_verifier` string: PKCE verifier.
  - `refresh_token` string: For the refresh grant.
  - `assertion` string: For the assertion grants.
  - `claim_token` string: For the claim grant's poll and later refreshes.
  - `client_id` string
  - `client_secret` string: With `client_secret_post` auth; Basic is also accepted.
  - `redirect_uri` string, uri
  - `resource` string, uri

## Response `200`

The issued token.

- TokenResponse: An issued credential.
  - `access_token` string, required
  - `token_type` 'Bearer', required
  - `expires_in` integer, required: Seconds until expiry.
  - `refresh_token` string
  - `scope` string, required: Space-separated granted scopes.
  - `identity_assertion` string: Claim grant only: the replacement assertion to hold from now on.
  - `assertion_expires` string, date-time: Claim grant only: when that assertion stops working.

## Other responses

- `400`: An OAuth error. `authorization_pending` and `expired_token` belong to the claim-grant poll, not failures to abort on.
- `401`: `invalid_client`: unknown or unusable client.
- `429`: `slow_down`: poll less often.

---

[API](https://skmtc.dev/supersetapp/apis/superset-api.md) - [All operations](https://skmtc.dev/supersetapp/apis/superset-api/llms.txt) - [OpenAPI document](https://skmtc.dev/supersetapp/apis/superset-api/revisions/80be14a3d402?raw)