# Exchange a code or a refresh token for tokens

POST`/oauth/token`

Request

**curl**


```bash
curl -X POST "https://tasksmate-fdfsarhnf5gacfb7.eastus-01.azurewebsites.net/oauth/token" \
  --data-urlencode "grant_type=<grant_type>"
```

Response 200

```json
{
  "access_token": "tm_live_Ab3xQ9eLr0v2Zk5n8WcHt1YpUo4MiGs7Fj6Da-_Bq0R",
  "expires_in": 3600,
  "refresh_token": "tmr_Zk5n8WcHt1YpUo4MiGs7Fj6Da-_Bq0RAb3xQ9eLr0v2",
  "scope": "tasks:write projects:read",
  "token_type": "Bearer"
}
```

Exchange an authorization code (with its PKCE verifier) or a refresh token for an access token and a new refresh token. Errors are OAuth JSON (`error`, `error_description`).

## Request Bodyrequired

application/x-www-form-urlencoded

_TokenRequest_object

**grant\_type**

required

string

Allowed values: authorization\_code refresh\_token

**code**

Authorization\_code: the code from the redirect

string

**redirect\_uri**

Authorization\_code: exactly the one in the authorization request

string

**code\_verifier**

Authorization\_code: the PKCE verifier (43-128 characters)

string

**refresh\_token**

Refresh\_token: the current refresh token (single use)

string

**scope**

Refresh\_token: optional, narrower scopes (space-separated)

string

**client\_id**

Required for a public app; a confidential app may send it with `client_secret` instead of HTTP Basic

string

**client\_secret**

`client_secret_post` (or use HTTP Basic)

string

## Responses

### 200

Successful Response

application/json

_TokenResponse_

Returned by `oauth.token`.

object

**access\_token**

required

_Access Token_

A TasksMate access token (`tm_live_…`), 1 hour

string

**token\_type**

_Token Type_

string

default: Bearer

Allowed value: Bearer

**expires\_in**

required

_Expires In_

Seconds

integer

**refresh\_token**

required

_Refresh Token_

`tmr_…` — single use: each refresh returns a new one

string

**scope**

required

_Scope_

Space-separated scopes this access token holds

string

Example

```json
{
  "access_token": "tm_live_Ab3xQ9eLr0v2Zk5n8WcHt1YpUo4MiGs7Fj6Da-_Bq0R",
  "expires_in": 3600,
  "refresh_token": "tmr_Zk5n8WcHt1YpUo4MiGs7Fj6Da-_Bq0RAb3xQ9eLr0v2",
  "scope": "tasks:write projects:read",
  "token_type": "Bearer"
}
```

### 400

An OAuth error (`invalid_request`, `invalid_grant`, `invalid_scope`, `unsupported_grant_type`)

application/json

_OAuthErrorBody_

A `OAuthErrorBody` object.

object

**error**

required

_Error_

Invalid\_request · invalid\_client · invalid\_grant · unauthorized\_client · unsupported\_grant\_type · invalid\_scope

string

**error\_description**

Any of:

**string**


string

**null**


null

Example

```json
{
  "error": "invalid_grant",
  "error_description": "string"
}
```

### 401

Client authentication failed (`invalid_client`)

application/json

_OAuthErrorBody_

A `OAuthErrorBody` object.

object

**error**

required

_Error_

Invalid\_request · invalid\_client · invalid\_grant · unauthorized\_client · unsupported\_grant\_type · invalid\_scope

string

**error\_description**

Any of:

**string**


string

**null**


null

Example

```json
{
  "error": "invalid_grant",
  "error_description": "string"
}
```

---
Source: https://developers.tasksmate.indrasol.com/reference/operations/oauthtoken/