---
title: "Obtain a new access token"
method: POST
path: "/oauth/token"
tags: ["Authentication"]
---

# Obtain a new access token

`POST /oauth/token`

## Request

- Base URL: `https://account-name.talkdeskid.com`
- URL: `https://account-name.talkdeskid.com/oauth/token`
- Auth: none declared

Obtain a new access token

## Headers

- `Authorization` string

## Request body `application/x-www-form-urlencoded`

- object
  - `grant_type` 'client_credentials' | 'authorization_code' | 'refresh_token', required: The grant type used for authentication
  - `code` string: Authorization code received from the "/oauth/authorize" request in the redirect URI. Required only when using "authorization_code" grant type
  - `redirect_uri` string: Redirect URI included in the "/oauth/authorize" request. Optional, used when grant type is "authorization_code"
  - `refresh_token` string: Refresh token previously issued in the authorization code flow. Required only when using "refresh_token" grant type
  - `token_type` 'opaque': Defaults to jwt. Required only for Service Tokens emission.
  - `expires_in` integer: Lifetime of the requested token, expressed in seconds. Optional, and only applicable when requesting service tokens. Min: 1 day (86400 seconds). Max: 1 year (31556952 seconds)
  - `scope` string: A space-separated list of scopes (URL encoded) the client is requesting access to. Optional, used only when requesting with "client_credentials" and "refresh_token" grant types. Whenever a new access token is being issued using "refresh_token" grant type, the requested scope must not include additional scopes that were not issued in the original access token and, if omitted, the new access token will be issued with the same scope as was previously issued
  - `client_assertion_type` 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer': The type of signed JWT assertion (it must be "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"). Required if not using HTTP Basic Auth in the Authorization header
  - `client_assertion` string: Signed JWT assertion (as per the "private_key_jwt" mechanism of OpenID Connect). Required if not using HTTP Basic Auth in the Authorization header

## Response `200`

The access token (and optional refresh token) generated, along with some additional properties about the authorization

- object
  - `access_token` string, required: The access token
  - `token_type` string, required: The type of token to be specified in the Authorization header
  - `expires_in` integer, required: Duration of time (seconds) the access token is granted for
  - `scope` string, required: A space-separated list of scopes (URL encoded) the client requested access to. If "scope" parameter was not provided in the request body parameter, the returned value will be the list of scopes the client granted
  - `refresh_token` string: The refresh token used to obtain another access token. Required only when using "authorization_code" and "refresh_token" grant types
  - `sid` string: The session ID of the user authenticated during the authorization code flow. Required only when using "authorization_code" and "refresh_token" grant types
  - `id_token` string: The ID token (OpenID Connect functionality to return information about the authentication performed during the authorization code flow). Required only when using "authorization_code" grant type and if "openid" scope was included in the "scope" parameter provided in the "/oauth/authorize" request query parameter

## Other responses

- `400`: Bad Request
- `401`: Unauthorized

---

[API](https://skmtc.dev/talkdesk/apis/authentication-api.md) - [All operations](https://skmtc.dev/talkdesk/apis/authentication-api/llms.txt) - [OpenAPI document](https://skmtc.dev/talkdesk/apis/authentication-api/revisions/cff3380d1fcc?raw)