> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ontime.hosai.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Token endpoint (RFC 6749 §5 / OAuth 2.1)

> Token endpoint (RFC 6749 §5 / OAuth 2.1). `authorization_code` grant exchanges a PKCE-verified, single-use code for an access+refresh pair; `refresh_token` grant rotates a refresh token (single-use, whole rotation family revoked on reuse). Public clients only — never a client_secret.



## OpenAPI

````yaml /api-reference/openapi.json post /api/oauth/token
openapi: 3.1.0
info:
  title: ontime API
  description: APIs for ontime.v2
  version: 1.0.0
servers:
  - url: https://app.ontime.hosai.app
    description: Production
security:
  - apiKey: []
paths:
  /api/oauth/token:
    post:
      tags:
        - OAuth
      summary: Token endpoint (RFC 6749 §5 / OAuth 2.1)
      description: >-
        Token endpoint (RFC 6749 §5 / OAuth 2.1). `authorization_code` grant
        exchanges a PKCE-verified, single-use code for an access+refresh pair;
        `refresh_token` grant rotates a refresh token (single-use, whole
        rotation family revoked on reuse). Public clients only — never a
        client_secret.
      operationId: postApiOauthToken
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  access_token:
                    type: string
                  token_type:
                    type: string
                    const: bearer
                  expires_in:
                    type: number
                  refresh_token:
                    type: string
                  scope:
                    type: string
                required:
                  - access_token
                  - token_type
                  - expires_in
                  - refresh_token
                  - scope
components:
  securitySchemes:
    apiKey:
      type: http
      scheme: bearer
      bearerFormat: ont_ API key
      description: >-
        Issue keys in Settings → API. Send them as `Authorization: Bearer ont_…`
        (an `X-Api-Key: ont_…` header is also accepted). Session-cookie routes
        are used by the OnTime web apps and are shown for completeness.

````