---
title: "Exchange a code, or refresh (RFC 6749 §3.2)"
method: POST
path: "/oauth/token"
tags: ["OAuth / MCP"]
---

# Exchange a code, or refresh (RFC 6749 §3.2)

`POST /oauth/token`

## Request

- Base URL: `https://whatareyoudo.ing/api/v1`
- URL: `https://whatareyoudo.ing/api/v1/oauth/token`
- Auth: none declared

application/x-www-form-urlencoded (JSON is accepted too). `authorization_code` needs `code`, `code_verifier` and the client; `refresh_token` rotates both tokens -- presenting a refresh token a second time revokes the connection. The access token is a personal access token (`whatcha_pat_...`) valid for an hour.

## Response `200`

Tokens

- OAuthTokenResponse
  - `access_token` string, required
  - `token_type` 'Bearer', required
  - `expires_in` integer, required
  - `refresh_token` string, required
  - `scope` 'read' | 'write', required

## Other responses

- `400`: invalid_grant, invalid_request, unsupported_grant_type, invalid_target
- `401`: invalid_client

---

[API](https://skmtc.dev/whatareyoudo/apis/whatcha-api.md) · [All operations](https://skmtc.dev/whatareyoudo/apis/whatcha-api/llms.txt) · [OpenAPI document](https://skmtc.dev/whatareyoudo/apis/whatcha-api/revisions/48dd8a54abea?raw)