> ## Documentation Index
> Fetch the complete documentation index at: https://docs-dev-feat-eup-870.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Get Token

> Exchange an authorization code for tokens using the Authorization Code Flow.

export const ResponseSchema = ({statusCode, type = "{}", children}) => {
  const [open, setOpen] = useState(false);
  return <div className="border border-gray-100 dark:border-gray-800 rounded-lg mb-3 overflow-hidden">
      <div className={`flex items-center gap-2.5 px-4 py-2.5 cursor-pointer select-none ${open ? "bg-gray-50 dark:bg-gray-800" : ""}`} onClick={() => setOpen(!open)}>
        {statusCode && <span className="border border-gray-300 dark:border-gray-600 text-gray-700 dark:text-gray-300 font-mono text-xs px-1.5 py-0.5 rounded">
            {statusCode.startsWith("default") ? "default" : statusCode}
          </span>}
        <span className="text-gray-500 dark:text-gray-400 text-sm font-mono">
          {type}
        </span>
        <span className="text-gray-400 dark:text-gray-500 text-sm italic">
          application/json
        </span>
        <svg className={`ml-auto opacity-50 transition-transform duration-200 ${open ? "rotate-180" : ""}`} width="16" height="16" viewBox="0 0 16 16" fill="none">
          <path d="M4 6l4 4 4-4" stroke="currentColor" strokeWidth="1.5" strokeLinecap="round" strokeLinejoin="round" />
        </svg>
      </div>
      {open && <div className="px-4 pt-1 pb-3 border-t border-gray-100 dark:border-gray-800">
          {children}
        </div>}
    </div>;
};

## Endpoint

`POST /oauth/token`

For token-based authentication, use the `oauth/token` endpoint to get an access token for your application to make authenticated calls to a secure API. Optionally, you can also retrieve an ID Token and a Refresh Token. ID Tokens contain user information in the form of scopes you application can extract to provide a better user experience. Refresh Tokens allow your application to request a new access token once the current token expires without interruping the user experience. To learn more, read [ID Tokens](https://auth0.com/docs/secure/tokens/id-tokens) and [Refresh Tokens](https://auth0.com/docs/secure/tokens/refresh-tokens).

Note that the only OAuth 2.0 flows that can retrieve a Refresh Token are:

* [Authorization Code Flow (Authorization Code)](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow)
* [Authorization Code Flow with PKCE (Authorization Code with PKCE)](https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow-with-pkce)
* [Resource Owner Password](https://auth0.com/docs/get-started/authentication-and-authorization-flow/resource-owner-password-flow)
* [Device Authorization Flow](https://auth0.com/docs/get-started/authentication-and-authorization-flow/device-authorization-flow)
* Token Exchange\*

This is the flow that regular web apps use to access an API. Use this endpoint to exchange an Authorization Code for a token.

## Headers

<ParamField header="DPoP" type="string">
  A DPoP proof for the request. This is optional and only required if your application uses Demonstrating Proof-of-Possession.
</ParamField>

## Body Parameters

<div className="prose-sm prose-gray dark:prose-invert">
  <span data-as="p">The request body is in `application/x-www-form-urlencoded` format.</span>
</div>

<ParamField body="grant_type" type="string" required>
  Denotes the flow you are using. For Authorization Code, use `authorization_code`.
</ParamField>

<ParamField body="client_id" type="string" required>
  Your application's Client ID.
</ParamField>

<ParamField body="client_secret" type="string" required>
  Your application's Client Secret.
</ParamField>

<ParamField body="code" type="string" required>
  The Authorization Code received from the initial `/authorize` call.
</ParamField>

<ParamField body="redirect_uri" type="string">
  This is required only if it was set at the [GET /authorize](#authorization-code-grant) endpoint. The values from `/authorize` must match the value you set at `/oauth/token`.
</ParamField>

## Response Schema

<ResponseSchema>
  <ResponseField name="access_token" type="string">
    The access token.
  </ResponseField>

  <ResponseField name="refresh_token" type="string">
    The refresh token used to obtain new access tokens.
  </ResponseField>

  <ResponseField name="id_token" type="string">
    The ID token.
  </ResponseField>

  <ResponseField name="token_type" type="string">
    The type of token. Usually `Bearer`.
  </ResponseField>

  <ResponseField name="expires_in" type="integer">
    The access token lifetime in seconds.
  </ResponseField>
</ResponseSchema>

## Agent access tokens

<Note>
  Agents as principals is an Early Access feature.
</Note>

When the application exchanging the code is linked to an agent and agent subject claims are enabled for the target API, the issued access token records the agent as the actor on the user's behalf:

* The `sub` claim remains the user identifier. The agent identity surfaces in the `act` claim, not in `sub`.
* The `act` claim identifies the agent: `{ "sub": "agt_72jbvv7LfRKYp59gtRLtkn", "sub_profile": "ai_agent", "client_id": "YOUR_CLIENT_ID", "iss": "https://YOUR_DOMAIN/" }`.
* The token includes `sub_profile: "user"` and `client_profile` with an `ai_agent` suffix, for example `web_app ai_agent`.

If the access token already carries an actor from a session transfer or an On-Behalf-Of exchange, that actor takes precedence and no agent actor is added. These claims apply to the access token only; the ID token is unaffected. The response shape is unchanged. To learn more, read [Access Token Profiles](/docs/secure/tokens/access-tokens/access-token-profiles#claims).

## Response Messages

| Status | Description                |
| ------ | -------------------------- |
| 200    | Successful token retrieval |