---
updatedAt: 2026-05-04T13:07:32.000Z
agentTools:
  projectIndex: https://developer.candis.io/llms.txt
---

# Create access token

This endpoint exchanges the authorization code or a refresh token for an access token. Clients may submit an authorization code to receive a new access and refresh token, or a refresh token to renew access.

# OpenAPI definition

```json
{
  "openapi": "3.0.0",
  "paths": {
    "/token": {
      "post": {
        "tags": [
          "OAuth 2.0 Authorization Code Flow"
        ],
        "security": [
          {
            "BasicAuth": []
          }
        ],
        "summary": "Create access token",
        "description": "This endpoint exchanges the authorization code or a refresh token for an access token. Clients may submit an authorization code to receive a new access and refresh token, or a refresh token to renew access.",
        "parameters": [
          {
            "name": "grant_type",
            "in": "query",
            "required": true,
            "description": "Specifies the type of grant.<br><br>authorization_code: To get a new token.<br>refresh_token: To renew existing access.",
            "schema": {
              "type": "string",
              "enum": [
                "authorization_code",
                "refresh_token"
              ]
            }
          },
          {
            "name": "code",
            "in": "query",
            "required": false,
            "description": "The authorization code received from the authorization request (required for 'authorization_code' grant type).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "refresh_token",
            "in": "query",
            "required": false,
            "description": "The refresh token received during the initial token exchange (required for 'refresh_token' grant type).",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "redirect_uri",
            "in": "query",
            "required": false,
            "description": "The same redirect_uri that was used in the authorization request (required for 'authorization_code' grant type).",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Access token and optionally a new refresh token are returned.",
            "content": {
              "application/json": {
                "schema": {
                  "type": "object",
                  "properties": {
                    "access_token": {
                      "type": "string",
                      "description": "The access token issued by the authorization server."
                    },
                    "refresh_token": {
                      "type": "string",
                      "description": "A token that can be used to obtain a new access token when the original expires."
                    },
                    "token_type": {
                      "type": "string",
                      "description": "The type of token issued (usually 'Bearer')."
                    },
                    "expires_in": {
                      "type": "integer",
                      "description": "The lifetime in seconds of the access token."
                    },
                    "refresh_expires_in": {
                      "type": "integer",
                      "description": "The lifetime in seconds of the access token."
                    },
                    "scope": {
                      "type": "string",
                      "description": "The scopes associated with the access token."
                    }
                  }
                }
              }
            }
          },
          "400": {
            "description": "Invalid request, such as missing parameters or invalid grant type."
          }
        }
      }
    }
  },
  "info": {
    "title": "Candis API",
    "version": "1.0",
    "description": "",
    "contact": {},
    "x-logo": {
      "url": "https://www.candis.io/img/candis-logo-black.svg",
      "altText": "Candis GmbH"
    }
  },
  "tags": [
    {
      "name": "OAuth 2.0 Authorization Code Flow",
      "description": "Endpoints for authorization and token exchange.",
      "externalDocs": {
        "description": "Related (external) documentation OAuth 2.0 Authorization Code Flow.",
        "url": "https://oauth.net/2/grant-types/authorization-code/"
      }
    }
  ],
  "servers": [
    {
      "url": "https://api.candis.io"
    },
    {
      "description": "Candis API Authorization Server.",
      "url": "https://id.my.candis.io/auth/realms/candis/protocol/openid-connect"
    }
  ],
  "components": {
    "securitySchemes": {
      "BasicAuth": {
        "type": "http",
        "scheme": "basic",
        "description": "Client ID and Client Secret as a header for BasicAuth."
      }
    }
  }
}
```