> ## Documentation Index
> Fetch the complete documentation index at: https://docs.passage.coinlist.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Issue OAuth access token

> Issues access tokens for `authorization_code`, `client_credentials`, and `refresh_token` grants using an `application/x-www-form-urlencoded` request body. For the `authorization_code` grant, the partner exchanges the code obtained from `GET /oauth/authorize` along with a PKCE `code_verifier`.



## OpenAPI

````yaml /api-reference/openapi.json post /oauth/token
openapi: 3.0.0
info:
  title: Frontline API
  version: 0.1.0
servers:
  - url: https://api.coinlist.co
    variables: {}
security: []
tags:
  - name: DocumentSubmissions
  - name: KYC
  - name: OAuth
  - name: Offers
  - name: Participations
  - name: Pii
  - name: Requirements
  - name: Swap
  - name: Token
  - name: Wallet
  - name: Wallet Ownership
paths:
  /oauth/token:
    post:
      tags:
        - OAuth
      summary: Issue OAuth access token
      description: >-
        Issues access tokens for `authorization_code`, `client_credentials`, and
        `refresh_token` grants using an `application/x-www-form-urlencoded`
        request body. For the `authorization_code` grant, the partner exchanges
        the code obtained from `GET /oauth/authorize` along with a PKCE
        `code_verifier`.
      operationId: FrontlineAPIWeb.Oauth.TokenController.OpenApiSpec.token
      parameters: []
      requestBody:
        content:
          application/x-www-form-urlencoded:
            schema:
              properties:
                client_id:
                  description: >-
                    OAuth client identifier. Required for all grant types when
                    client authentication is sent in the request body.
                  type: string
                  x-struct: null
                  x-validate: null
                client_secret:
                  description: >-
                    OAuth client secret. Required for all grant types when
                    client authentication is sent in the request body.
                  type: string
                  x-struct: null
                  x-validate: null
                code:
                  description: >-
                    Authorization code received from the `/oauth/authorize`
                    endpoint. Required when `grant_type` is
                    `authorization_code`.
                  type: string
                  x-struct: null
                  x-validate: null
                code_verifier:
                  description: >-
                    PKCE code verifier corresponding to the `code_challenge`
                    sent to `/oauth/authorize`. Required when `grant_type` is
                    `authorization_code`.
                  type: string
                  x-struct: null
                  x-validate: null
                grant_type:
                  description: >-
                    OAuth grant type. Supported values are `authorization_code`,
                    `client_credentials`, and `refresh_token`.
                  enum:
                    - authorization_code
                    - client_credentials
                    - refresh_token
                  type: string
                  x-struct: null
                  x-validate: null
                redirect_uri:
                  description: >-
                    Must match the `redirect_uri` used in the original
                    `/oauth/authorize` request. Required when `grant_type` is
                    `authorization_code`.
                  format: uri
                  type: string
                  x-struct: null
                  x-validate: null
                refresh_token:
                  description: Required when `grant_type` is `refresh_token`.
                  type: string
                  x-struct: null
                  x-validate: null
              required:
                - grant_type
              type: object
              x-struct: null
              x-validate: null
        description: Token request params
        required: false
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OauthToken'
          description: Successful token response
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OauthError'
          description: OAuth error response
        '401':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OauthError'
          description: OAuth error response
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OauthError'
          description: OAuth error response
      callbacks: {}
      security: []
components:
  schemas:
    OauthToken:
      additionalProperties: false
      properties:
        access_token:
          description: The access token
          type: string
          x-struct: null
          x-validate: null
        expires_in:
          description: Token lifetime in seconds
          type: integer
          x-struct: null
          x-validate: null
        id_token:
          description: OpenID Connect ID token
          type: string
          x-struct: null
          x-validate: null
        refresh_token:
          description: The refresh token
          type: string
          x-struct: null
          x-validate: null
        token_type:
          description: Token type, e.g. Bearer
          type: string
          x-struct: null
          x-validate: null
      required:
        - token_type
        - access_token
        - expires_in
      title: OauthToken
      type: object
      x-struct: Elixir.FrontlineAPIWeb.OpenApi.Oauth.Schemas.OauthToken
      x-validate: null
    OauthError:
      additionalProperties: false
      properties:
        error:
          description: OAuth error code
          type: string
          x-struct: null
          x-validate: null
        error_description:
          description: Human-readable error description
          type: string
          x-struct: null
          x-validate: null
      required:
        - error
        - error_description
      title: OauthError
      type: object
      x-struct: Elixir.FrontlineAPIWeb.OpenApi.Oauth.Schemas.OauthError
      x-validate: null

````