---
title: "Exchange a token grant"
method: POST
path: "/oauth2/token"
tags: ["OAuth2"]
---

# Exchange a token grant

`POST /oauth2/token`

Exchange a token grant.

## Response `200`

OK

- object
  - `access_token` string
  - `refresh_token` string
  - `token_type` string — Always 'bearer'
  - `expires_in` integer — Token lifetime in seconds
  - `scope` string — Space-separated list of granted scopes
  - `issue_date` integer

## Other responses

- `default` — Error

## Changes

- **2026-03-18** `e271d0e41f6d` — 2 breaking, 3 info
  - request body became required
  - removed the media type `application/json` from the request body
  - api operation id `post_oauth2_token` removed and replaced with `postOauth2Token`
  - added the new optional `header` request parameter `XF-Api-User` to all path's operations
  - …1 more
- **2026-03-06** `61b60b0c0d52` — 4 info
  - api tag `OAuth2` added
  - api tag `oauth2` removed
  - added optional request body
  - added the media type `application/json` for the response with the status `200`
- **2026-02-03** `fc0a40f3b859` — 2 breaking, 4 warning, 3 info
  - removed the request body
  - removed the media type `application/json` for the response with the status `200`
  - the optional response header `XF-Latest-Api-Version` removed for the status `200`
  - the optional response header `XF-Request-User` removed for the status `200`
  - …5 more

[Change history](https://skmtc.dev/xenforo-ltd/apis/xenforo-api/changes/oauth2/token/post.md)

---

[API](https://skmtc.dev/xenforo-ltd/apis/xenforo-api.md) · [All operations](https://skmtc.dev/xenforo-ltd/apis/xenforo-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/xenforo-ltd/xenforo-api/revisions/b15eba33657a/schema)