---
title: "Request OAuth2 token"
method: POST
path: "/core/oauth2/token"
tags: ["Authentication"]
---

# Request OAuth2 token

`POST /core/oauth2/token`

## Request

- Base URL: `https://api.enterprise.sandbox.uphold.com`
- URL: `https://api.enterprise.sandbox.uphold.com/core/oauth2/token`
- Auth: none required
- TypeScript: <https://skmtc.dev/uphold/apis/core-api/docs/core/oauth2/token/post.ts> (a function with typed inputs; its response is checked against the schema)

Request an access token using OAuth2 protocol.

## Headers

- `Authorization` string

## Request body `application/x-www-form-urlencoded`

- union
  - object
    - `grant_type` 'client_credentials', required
    - `scope` string: The list of scopes, delimited with spaces.
  - object
    - `grant_type` 'refresh_token', required
    - `refresh_token` string, required: The refresh token string.
    - `scope` string: The list of scopes, delimited with spaces.

## Response `200`

Token created successfully.

- Oauth2Token
  - `access_token` string, required: The access token string issued.
  - `refresh_token` string: The refresh token string issued (only applicable to certain grant types).
  - `expires_in` integer, required: The number of seconds until the token expires.
  - `scope` string: The list of scopes, delimited with spaces.
  - `token_type` 'Bearer', required

## Other responses

- `400`: Bad Request.
- `401`: Unauthorized.
- `429`: Too Many Requests.

---

[API](https://skmtc.dev/uphold/apis/core-api.md) - [All operations](https://skmtc.dev/uphold/apis/core-api/llms.txt) - [OpenAPI document](https://skmtc.dev/uphold/apis/core-api/revisions/6c663575c57a?raw)