# Exchange a code or refresh token for an access token

> The token endpoint, serving the `authorization_code` and `refresh_token` grants. The client

<Heading
  as={"h1"}
  className={"openapi__heading"}
  children={"Exchange a code or refresh token for an access token"}
>
</Heading>

<MethodEndpoint
  method={"post"}
  path={"/token"}
  context={"endpoint"}
>
  
</MethodEndpoint>

The token endpoint, serving the `authorization_code` and `refresh_token` grants. The client
authenticates with `client_secret_basic`, `client_secret_post`, or `none` for a public client.

The access token it returns is a SOAT-issued JWT: send it as `Authorization: Bearer <token>`
to `/mcp` and to the REST API. Refresh tokens are single-use and rotated on every exchange.

<Heading
  id={"request"}
  as={"h2"}
  className={"openapi-tabs__heading"}
>
  <Translate id="theme.openapi.request.title">Request</Translate>
</Heading>

<ParamsDetails>
  
</ParamsDetails>

<RequestSchema
  {...require("./create-oauth-token.RequestSchema.json")}
>
  
</RequestSchema>

<StatusCodes
  {...require("./create-oauth-token.StatusCodes.json")}
>
  
</StatusCodes>