Token Endpoint

Exchange authorization code for access token OR issue client credentials token.

Quick Navigation

• Endpoint
• Headers
• Form Parameters (Authorization Code Grant)
• Form Parameters (Client Credentials Grant)
• Response
• Success (200)
• Error (400)
• Features
• Example - Authorization Code
• Example - Client Credentials
• Related Endpoints

Endpoint

POST /oauth/token

Headers

Header	Required	Description
Content-Type	Yes	application/x-www-form-urlencoded

Form Parameters (Authorization Code Grant)

Parameter	Type	Required	Description
grant_type	string	Yes	Must be "authorization_code"
code	string	Yes	Authorization code from /authorize endpoint
redirect_uri	string	Yes	Must match the redirect_uri used in authorization
code_verifier	string	No	PKCE code verifier (required if PKCE was used)
client_id	string	Yes	OAuth application client ID
client_secret	string	Yes	OAuth application client secret

Form Parameters (Client Credentials Grant)

Parameter	Type	Required	Description
grant_type	string	Yes	Must be "client_credentials"
client_id	string	Yes	OAuth application client ID
client_secret	string	Yes	OAuth application client secret
scope	string	No	Space-separated list of requested scopes

Response

Success (200)

{
  "access_token": "eyJhbGciOiJIUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "eyJhbGciOiJIUzI1NiIs...",
  "scope": "read write"
}

Error (400)

{
  "error": "invalid_grant",
  "error_description": "Invalid authorization code"
}

Features

• Supports Authorization Code grant
• Supports Client Credentials grant
• Validates PKCE code verifier if used
• Returns access token and refresh token
• Token expiration follows organization settings

Example - Authorization Code

curl -X POST "https://api.rivergen.com/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code&code=AUTHORIZATION_CODE&redirect_uri=https://myapp.com/callback&client_id=CLIENT_ID&client_secret=CLIENT_SECRET&code_verifier=CODE_VERIFIER"

Example - Client Credentials

curl -X POST "https://api.rivergen.com/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials&client_id=CLIENT_ID&client_secret=CLIENT_SECRET&scope=read write"

Related Endpoints

• Authorization Endpoint - Get authorization code
• Token Revocation - Revoke token