---
title: "authorization_code (PKCE) or refresh_token (rotating) → an hour-long wz_ access token and a wzr_ refresh token"
method: POST
path: "/api/oauth/token"
tags: ["oauth"]
---

# authorization_code (PKCE) or refresh_token (rotating) → an hour-long wz_ access token and a wzr_ refresh token

`POST /api/oauth/token`

## Request

- Base URL: `https://api.wizbi.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.wizbi.ai/api/oauth/token`
- Auth: none declared

## Response `200`

Token (`Cache-Control: no-store`).

- object

## Other responses

- `400`: invalid_grant / invalid_request / unsupported_grant_type / invalid_scope / invalid_target.
- `401`: invalid_client.

---

[API](https://skmtc.dev/wizbi/apis/wizbi-core-api.md) · [All operations](https://skmtc.dev/wizbi/apis/wizbi-core-api/llms.txt) · [OpenAPI document](https://skmtc.dev/wizbi/apis/wizbi-core-api/revisions/5a47416c82ec?raw)