---
title: "Exchange OAuth2 token"
method: POST
path: "/oauth/token"
tags: ["oAuth2"]
---

# Exchange OAuth2 token

`POST /oauth/token`

<Warning>
This endpoint expects `application/x-www-form-urlencoded`.
</Warning>
<Warning>
Try it will not return usable data for this route. It depends on a live OAuth2 authentication context outside the docs.
</Warning>
<Info>
Get started with OAuth by reading [our guide](/oauth2/creating-an-application).
</Info>
<Info>
Only the `authorization_code` grant type is supported. Authorization codes are one-time use and expire after 5 minutes.
</Info>

PKCE is supported for both Private and Public applications but Public applications must send `code_verifier` and must not send `client_secret`.

Private applications must send `client_secret`.

Only `S256` PKCE is supported.

## Request body

- OAuthTokenExchangeRequest
  - `grant_type` 'authorization_code', required — Only `authorization_code` is supported.
  - `code` string, required — One-time authorization code. Expires after 5 minutes.
  - `redirect_uri` string, uri, required — Must match the redirect URI used during authorization.
  - `client_id` string, required
  - `client_secret` string — Required for private applications. Must not be sent by public applications.
  - `code_verifier` string — Required for public applications and for any authorization code created with PKCE.

## Response `200`

OAuth2 access token exchange result.

- OAuthTokenResponse
  - `access_token` string, required
  - `token_type` 'bearer', required
  - `scope` string, required — Space-delimited granted scopes.

---

[API](https://skmtc.dev/wynncraft/apis/modules.md) · [All operations](https://skmtc.dev/wynncraft/apis/modules/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/wynncraft/modules/revisions/6c6214729eae/schema)