---
title: "Get an OAuth access token"
method: POST
path: "/api/oauth/token"
tags: ["Agent Discovery"]
---

# Get an OAuth access token

`POST /api/oauth/token`

## Request

- Base URL: `https://xquik.com`
- URL: `https://xquik.com/api/oauth/token`
- Auth: none required

Exchange an authorization code, a refresh token, an agent claim token or an identity assertion for an access token.

## Request body `application/x-www-form-urlencoded`

- union: Form fields of a token request. Each grant_type has its own fields.
  - OAuthAuthorizationCodeGrant: Form fields that name the client & authenticate it.
    - `client_id` string: Required unless client_assertion or a Basic Authorization header with an empty password names the client.
    - `client_secret` string: Required for clients registered with client_secret_post.
    - `client_assertion` string: A signed JWT for clients whose metadata document names private_key_jwt.
    - `client_assertion_type` 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer': Required with client_assertion.
    - `grant_type` 'authorization_code', required
    - `code` string, required: The authorization code from the redirect.
    - `code_verifier` string, required: The PKCE verifier of the code_challenge.
    - `redirect_uri` string: The redirect_uri of the authorization request.
    - `resource` string: The resource of the authorization request. Defaults to the MCP server.
  - OAuthRefreshTokenGrant: Form fields that name the client & authenticate it.
    - `client_id` string: Required unless client_assertion or a Basic Authorization header with an empty password names the client.
    - `client_secret` string: Required for clients registered with client_secret_post.
    - `client_assertion` string: A signed JWT for clients whose metadata document names private_key_jwt.
    - `client_assertion_type` 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer': Required with client_assertion.
    - `grant_type` 'refresh_token', required
    - `refresh_token` string, required: The latest refresh token. Each refresh token works once.
    - `scope` string: It must equal the granted scope.
    - `resource` string: The resource of the first token. Defaults to the MCP server.
  - OAuthAgentClaimGrant: Poll for the access token of a claimed agent.
    - `grant_type` 'urn:workos:agent-auth:grant-type:claim', required
    - `claim_token` string, required: The claim_token of the agent registration.
  - OAuthIdentityAssertionGrant: Trade a claimed agent's identity assertion for an access token.
    - `grant_type` 'urn:ietf:params:oauth:grant-type:jwt-bearer', required
    - `assertion` string, required: A current identity_assertion from the claim grant.

## Response `200`

The access token. Code & refresh grants also return a new refresh token. A claim grant returns identity_assertion instead.

- OAuthToken: An issued OAuth access token.
  - `access_token` string, required: Send it as a Bearer token.
  - `token_type` 'Bearer', required
  - `expires_in` integer, required: Seconds until the access token expires.
  - `scope` string, required: The granted scopes, space-separated.
  - `refresh_token` string: Only code & refresh grants return it. Each refresh token works once, so store the latest one.
  - `identity_assertion` string: Only the claim grant returns it. Send it with the jwt-bearer grant for a new access token.
  - `assertion_expires` string, date-time: When identity_assertion expires.

## Other responses

- `400`: The grant failed. While the user hasn't claimed the agent yet, a claim poll answers authorization_pending or slow_down.
- `401`: The client is unknown or its credentials are wrong.
- `413`: The request body exceeds 16 KiB.
- `415`: The body isn't application/x-www-form-urlencoded.
- `429`: Too many token requests. Retry after Retry-After.
- `500`: Unexpected error.
- `default`: Unexpected error.

## Changes

- **2026-11-02** `20d4bcaa8f4e`: 1 breaking, 1 info
  - the `expires_in` response's property format changed from `int64` to no format for status `200`
  - removed the non-success response with the status `500`
- **2026-11-02** `48f2012c62b3`: 1 info
  - added the non-success response with the status `500`
- **2026-11-01** `1863d7ef8b4d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/xquik-dev/apis/xquik-api/changes/api/oauth/token/post.md)

---

[API](https://skmtc.dev/xquik-dev/apis/xquik-api.md) - [All operations](https://skmtc.dev/xquik-dev/apis/xquik-api/llms.txt) - [OpenAPI document](https://skmtc.dev/xquik-dev/apis/xquik-api/revisions/db6708e077dc?raw)