---
title: "Token endpoint (exchange code or refresh token)."
method: POST
path: "/api/oauth/token"
tags: ["OAuth"]
---

# Token endpoint (exchange code or refresh token).

`POST /api/oauth/token`

## Request

- Base URL: `https://app.tracepass.eu`
- URL: `https://app.tracepass.eu/api/oauth/token`
- Auth: none required

RFC 6749 §3.2. Form-encoded. `grant_type=authorization_code`
exchanges a PKCE-bound code (send `code_verifier`) for a 15-min
access token (+ refresh token when `offline_access` was
granted). `grant_type=refresh_token` rotates the refresh token.
Confidential clients also send `client_secret`. Responses are
`Cache-Control: no-store`.

## Response `200`

Access token issued.

- object
  - `access_token` string
  - `token_type` 'Bearer'
  - `expires_in` integer
  - `scope` string
  - `refresh_token` string: Present only when offline_access was granted.

## Other responses

- `400`: invalid_grant / invalid_request / unsupported_grant_type.
- `401`: invalid_client (bad client authentication).

---

[API](https://skmtc.dev/tracepass/apis/tracepass-api.md) · [All operations](https://skmtc.dev/tracepass/apis/tracepass-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tracepass/apis/tracepass-api/revisions/60ddeb25638b?raw)