---
title: "Token endpoint: authorization_code (PKCE) and refresh_token (rotating)"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# Token endpoint: authorization_code (PKCE) and refresh_token (rotating)

`POST /oauth/token`

## Request

- Base URL: `https://whenmeet.me`
- URL: `https://whenmeet.me/oauth/token`
- Auth: none required

Access tokens are mn_… Bearer tokens valid for 1 hour, only at /mcp. Refresh tokens (mnr_…) last 60 days from their last use and are rotated on every refresh; presenting a rotated-out refresh token revokes the whole grant.

## Request body

- object

## Response `200`

{ access_token, token_type: "Bearer", expires_in: 3600, refresh_token, scope }

- object

## Other responses

- `400`: invalid_grant | invalid_request | invalid_scope | invalid_target | unsupported_grant_type
- `401`: invalid_client

---

[API](https://skmtc.dev/whenmeet/apis/whenmeet-me-api.md) · [All operations](https://skmtc.dev/whenmeet/apis/whenmeet-me-api/llms.txt) · [OpenAPI document](https://skmtc.dev/whenmeet/apis/whenmeet-me-api/revisions/202b80022215?raw)