---
title: "OAuth 2.1 token endpoint (authorization_code and refresh_token)"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# OAuth 2.1 token endpoint (authorization_code and refresh_token)

`POST /oauth/token`

## Request

- Base URL: `https://tre-app.com`
- URL: `https://tre-app.com/oauth/token`
- Auth: none required

RFC 6749 token endpoint. Body is `application/x-www-form-urlencoded`. Answers 404 while `OAUTH_ENABLED` is off. No Tre bearer — clients authenticate with CIMD (`none` public clients or `private_key_jwt`). Access tokens last one hour; each refresh rotates the refresh token and grants it another 30 days (sliding), under an absolute cap of 90 days from the grant’s creation — past it the refresh answers `invalid_grant`, the grant is revoked, and the person consents again. Every refusal of an authorization code answers `invalid_grant` with the one description "The authorization code is invalid". A `resource` (RFC 8707) is optional; every one sent must be this server’s MCP endpoint, or the request answers `invalid_target`. Failures use the OAuth error object (`error` / `error_description`), not Tre’s `{ error: { code, message } }` shape.

## Response `200`

Success

- OAuthTokenResponse
  - `access_token` string, required
  - `token_type` 'Bearer', required: Always `Bearer`, spelled as RFC 6750 registers it; RFC 6749 §5.1 has clients compare the value case-insensitively.
  - `expires_in` integer, required
  - `refresh_token` string, required
  - `scope` 'read' | 'write' | 'admin', required

## Other responses

- `400`: OAuth error: `invalid_request` (a form field that fails validation is named as `<field> is missing` or `<field> is invalid`), `invalid_grant`, `unsupported_grant_type`, or — on the token endpoint — `invalid_target`.
- `401`: invalid_client
- `404`: OAuth door is off (`OAUTH_ENABLED` unset or not `true`).
- `429`: Rate limited: `invalid_request`, and `Retry-After` names the wait.
- `500`: server_error
- `503`: server_error (dependency), with `Retry-After`.

---

[API](https://skmtc.dev/tre-app/apis/tre-rest-api.md) · [All operations](https://skmtc.dev/tre-app/apis/tre-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tre-app/apis/tre-rest-api/revisions/26a7187a05fc?raw)