---
title: "OAuth 2.1 token endpoint"
method: POST
path: "/oauth2/token"
tags: ["OAuth"]
---

# OAuth 2.1 token endpoint

`POST /oauth2/token`

## Request

- Base URL: `https://api.uptimemonitoring.com`
- URL: `https://api.uptimemonitoring.com/oauth2/token`
- Auth: none required

Exchanges an authorization code (with PKCE verifier) or a refresh
token for a JWT access token + refresh token. Refresh tokens
rotate: the presented token is revoked and a new one is returned.
JWT claims: `iss`, `sub` (= account ID), `aud=mcp`, `exp` (~1 h),
`iat`, `jti`, `client_id`, `scope`.

## Response `200`

Token response.

- object
  - `access_token` string
  - `token_type` 'Bearer'
  - `expires_in` integer
  - `refresh_token` string
  - `scope` string

## Other responses

- `400`: invalid_grant / invalid_request.
- `401`: invalid_client.
- `500`: Two distinct `server_error` shapes share this status, distinguishable by the `error_description` body: 1. **Generic pre-persistence failure** — token minting (JWT signing, random token generation) failed before any commit was attempted. `error_description: "could not mint tokens"`. No authorization code was consumed and no refresh token was revoked; safe to retry with the same grant. 2. **Commit outcome unknown** (e.g. a connection drop mid-commit) — the presented authorization code or refresh token may already be consumed/revoked even though this request failed. `error_description` explicitly says the outcome is unknown and tells the client to restart the authorization flow. This is an advisory distinction, not an RFC 6749 retry guarantee (RFC 6749 does not classify `server_error` as non-retryable, and OAuth client libraries commonly auto-retry any 5xx regardless of the `error` field) — resending the same grant after this response can fail with `invalid_grant` if the ambiguous commit actually landed, but this API cannot force a well-behaved client to avoid that resend.
- `503`: `temporarily_unavailable` — a transient backend error left the presented code/refresh token untouched (the transaction rolled back). Safe to retry.

---

[API](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api.md) · [All operations](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api/llms.txt) · [OpenAPI document](https://skmtc.dev/uptimemonitoring/apis/uptimemonitoring-com-api/revisions/ddcb2a8bc70f?raw)