---
title: "Token endpoint"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# Token endpoint

`POST /oauth/token`

## Request

- Base URL: `https://xn--s7y.xn--3ds443g`
- URL: `https://xn--s7y.xn--3ds443g/oauth/token`
- Auth: none required

`grant_type=authorization_code` or `refresh_token`. Public clients (`client_id` only, no client secret). Form body or JSON. An authorization code is single-use and bound to `client_id`, `redirect_uri`, and the S256 verifier. Refresh rotates the refresh token. Optional `scope` may only narrow the granted scope. Other grant types are `unsupported_grant_type`.

## Request body

- OAuthTokenRequest
  - `grant_type` 'authorization_code' | 'refresh_token', required
  - `client_id` string, required
  - `code` string
  - `redirect_uri` string
  - `code_verifier` string
  - `refresh_token` string
  - `scope` string: Optional. May only narrow the granted scope.

## Response `200`

Access token

- OAuthTokenResponse
  - `access_token` string, required
  - `token_type` 'Bearer', required
  - `expires_in` integer, required: Access token lifetime in seconds (3600).
  - `refresh_token` string, required
  - `scope` string, required

## Other responses

- `400`: invalid_request, invalid_grant, invalid_client, invalid_scope, or unsupported_grant_type

---

[API](https://skmtc.dev/xn--s7y/apis/agent-api.md) · [All operations](https://skmtc.dev/xn--s7y/apis/agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/xn--s7y/apis/agent-api/revisions/d902f68518e9?raw)