# Trade a code or a refresh token for tokens

> Page: https://docs.plotwork.dev/api/post-oauth-token. Index of every page: https://docs.plotwork.dev/llms.txt

Form-encoded.

`POST /oauth/token`

## TL;DR

| Question | Answer |
|---|---|
| What does it do? | Trade a code or a refresh token for tokens. |
| What does it take? | Nothing. |
| What does it return? | Status 200 with a body of type [`TokenAnswer`](https://docs.plotwork.dev/api/schemas.md#tokenanswer). |
| What can go wrong? | `400` invalid_request, invalid_grant, invalid_scope or unsupported_grant_type; `401` invalid_client; `429` too many requests; `503` sign in with Plotwork is not available on this server (oauth.unavailable). Every failure uses the one error envelope. |

## What it does

Form-encoded. authorization_code with the code, the same redirect_uri and the PKCE code_verifier, or refresh_token with the refresh token. A confidential app sends its secret by HTTP Basic or client_secret. The access token works an hour; the refresh token 30 days and once, and one presented again ends the grant. Errors are OAuth's { error, error_description }.

## Responses

| Status | Meaning | Body |
|---|---|---|
| 200 | The tokens. | [`TokenAnswer`](https://docs.plotwork.dev/api/schemas.md#tokenanswer) |
| 400 | invalid_request, invalid_grant, invalid_scope or unsupported_grant_type. | [`OAuthError`](https://docs.plotwork.dev/api/schemas.md#oautherror) |
| 401 | invalid_client. | [`OAuthError`](https://docs.plotwork.dev/api/schemas.md#oautherror) |
| 429 | Too many requests. | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |
| 503 | Sign in with Plotwork is not available on this server (oauth.unavailable). | [`ErrorResponse`](https://docs.plotwork.dev/api/schemas.md#errorresponse) |

## Response body

A 200 answer has the type [`TokenAnswer`](https://docs.plotwork.dev/api/schemas.md#tokenanswer).

| Field | Type | Required | Description |
|---|---|---|---|
| `access_token` | `string` | yes | pwa_... Send it as Authorization: Bearer. Works for an hour. |
| `token_type` | `"Bearer"` | yes |  |
| `expires_in` | `integer` | yes |  |
| `refresh_token` | `string` | yes | pwr_... Works once, for 30 days; a refresh answers a new one. |
| `scope` | `string` | yes |  |

## See also

| Doc | Why |
|---|---|
| [API reference](https://docs.plotwork.dev/api/reference.md) | Every endpoint, and the error envelope |
| [Schemas](https://docs.plotwork.dev/api/schemas.md) | Every request and response type |
| [Tool reference](https://docs.plotwork.dev/mcp/tools.md) | The operations as callable tools |