---
title: "POST /oauth/token"
method: POST
path: "/oauth/token"
---

# POST /oauth/token

`POST /oauth/token`

## Request

- Base URL: `https://api.useanima.sh/v1`
- URL: `https://api.useanima.sh/v1/oauth/token`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

## Request body

- object: OAuth 2.1 token-exchange request
  - `grantType` 'authorization_code' | 'refresh_token', required
  - `code` string
  - `redirectUri` string, uri
  - `clientId` string
  - `codeVerifier` string
  - `refreshToken` string

## Response `200`

OK

- object: OAuth token response (RFC 6749 §5.1)
  - `accessToken` string, required: `oat_*` access token; bearer in Authorization header
  - `tokenType` 'Bearer', required
  - `expiresIn` integer, required: Seconds until access token expires
  - `refreshToken` string: Rotating refresh token. Each /token call issues a new RT; the old one is consumed and any further use of it triggers chain revocation.
  - `refreshTokenExpiresIn` integer: Seconds until the refresh token expires (~30 days)
  - `scope` string, required: Space-delimited granted scope list

## Other responses

- `400`: 400
- `401`: 401

---

[API](https://skmtc.dev/useanima/apis/anima-api.md) · [All operations](https://skmtc.dev/useanima/apis/anima-api/llms.txt) · [OpenAPI document](https://skmtc.dev/useanima/apis/anima-api/revisions/aaa148188980?raw)