---
title: "Exchange an authorization code, or refresh"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# Exchange an authorization code, or refresh

`POST /oauth/token`

## Request

- Base URL: `https://youspot.com`
- URL: `https://youspot.com/oauth/token`
- Auth: none required

Refresh tokens rotate: every refresh returns a new one and invalidates the old, and reusing a spent one invalidates the whole grant chain. Store only the newest.

## Response `200`

The access token.

- TokenResponse
  - `access_token` string, required
  - `token_type` 'Bearer', required
  - `expires_in` integer
  - `refresh_token` string
  - `scope` string

## Other responses

- `400`: The request was refused. `error` is stable; read `error_description` for the reason.

---

[API](https://skmtc.dev/youspot/apis/youspot-http-api.md) · [All operations](https://skmtc.dev/youspot/apis/youspot-http-api/llms.txt) · [OpenAPI document](https://skmtc.dev/youspot/apis/youspot-http-api/revisions/6615ad5d017d?raw)