> For the complete documentation index, see [llms.txt](https://docs.defguard.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.defguard.net/for-developers/rest-api/core/oauth2/exchange-an-authorization-code-or-a-refresh-token-for-tokens.md).

# Exchange an authorization code or a refresh token for tokens

Accepts `application/x-www-form-urlencoded` and supports the `authorization_code` and `refresh_token` grants. The client authenticates with HTTP Basic auth or with `client_id`/`client_secret` in the form body. Implements the [OpenID Connect token endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).

```json
{"openapi":"3.1.0","info":{"title":"defguard Core API","version":"2.0.3"},"tags":[{"name":"OAuth2","description":"defguard acting as an OAuth2 / OpenID Connect provider for other applications."}],"paths":{"/api/v1/oauth/token":{"post":{"tags":["OAuth2"],"summary":"Exchange an authorization code or a refresh token for tokens","description":"Accepts `application/x-www-form-urlencoded` and supports the `authorization_code` and\n`refresh_token` grants. The client authenticates with HTTP Basic auth or with\n`client_id`/`client_secret` in the form body. Implements the\n[OpenID Connect token endpoint](https://openid.net/specs/openid-connect-core-1_0.html#TokenEndpoint).","operationId":"token","requestBody":{"description":"`grant_type`, `code` or `refresh_token`, `redirect_uri`, `code_verifier`, and optionally `client_id`/`client_secret`.","content":{"application/x-www-form-urlencoded":{"schema":{"type":"object"}}},"required":true},"responses":{"200":{"description":"Access token, and an ID token when the `openid` scope was requested.","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Invalid grant or invalid request.","content":{"application/json":{"schema":{"type":"object"}}}},"401":{"description":"Invalid client credentials.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrorResponse"}}}},"500":{"description":"Unable to issue token.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ApiErrorResponse"}}}}}}}},"components":{"schemas":{"ApiErrorResponse":{"type":"object","description":"Body returned with error responses.","required":["msg"],"properties":{"code":{"type":["string","null"],"description":"Machine-readable error code, returned for selected errors."},"msg":{"type":"string","description":"Human-readable error message."}}}}}}
```