---
title: "Exchange a grant for tokens"
method: POST
path: "/api/oauth/token"
tags: ["OAuth"]
---

# Exchange a grant for tokens

`POST /api/oauth/token`

## Request

- Base URL: `https://app.walkeros.io`
- URL: `https://app.walkeros.io/api/oauth/token`
- Auth: none declared

RFC 6749 section 3.2. Runs the authorization code and refresh token grants. Every client is public: it sends its `client_id` in the form and proves itself with PKCE, and a request that presents a client secret is refused with `invalid_client` (with a `WWW-Authenticate: Basic` challenge when it tried HTTP Basic). Body is `application/x-www-form-urlencoded` only; errors use the RFC 6749 section 5.2 shape, not the standard error envelope. Responses are never cacheable. Rate limited per `client_id`, and per `client_id` and address for a client id metadata URL.

## Response `200`

Tokens issued

- TokenResponse
  - `access_token` string, required
  - `token_type` 'Bearer', required
  - `expires_in` integer, required
  - `refresh_token` string
  - `scope` string, required

## Other responses

- `400`: invalid_request, invalid_grant, invalid_scope, invalid_target or unsupported_grant_type
- `401`: invalid_client: unknown or revoked client, or a request that presents a client secret
- `429`: Per-client token budget reached (Retry-After header)

---

[API](https://skmtc.dev/walkeros/apis/walkeros-tag-manager-api.md) · [All operations](https://skmtc.dev/walkeros/apis/walkeros-tag-manager-api/llms.txt) · [OpenAPI document](https://skmtc.dev/walkeros/apis/walkeros-tag-manager-api/revisions/1b692e17a011?raw)