> ## Documentation Index
> Fetch the complete documentation index at: https://gproxy.leenhawk.com/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /v1/oauth/token



## OpenAPI

````yaml /generated/openapi.json post /v1/oauth/token
openapi: 3.1.0
info:
  description: >-
    Forwarding, management, portal and OAuth APIs generated from Rust types.
    Input and output schemas preserve their respective Serde contracts.
    Streaming events and WebSocket messages are documented alongside HTTP
    payloads.
  title: GPROXY HTTP API
  version: 4.2.1
servers: []
security:
  - bearer: []
  - anthropicKey: []
  - googleKey: []
  - queryKey: []
paths:
  /v1/oauth/token:
    post:
      tags:
        - OAuth
      summary: POST /v1/oauth/token
      parameters: []
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Input_TokenRequest'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Input_TokenRequest'
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Output_TokenResponse'
          description: Success
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Output_OAuthErrorBody'
          description: OAuth error
      security: []
components:
  schemas:
    Input_TokenRequest:
      description: >-
        RFC 6749 §4.1.3 / §6 and RFC 8628 §3.4, in one shape.


        Which fields must be present depends on `grant_type`, so all of them are

        optional here and the issuer names what is missing. That is deliberate:
        a

        client that sends `code` with `grant_type=refresh_token` deserves

        `invalid_request: refresh_token is required`, not a parse error listing

        every field of every grant type.
      properties:
        client_id:
          default: ''
          description: >-
            Required for every grant type. These are public clients — there is
            no

            client secret to authenticate with — so this names the client and is

            checked against the grant, never trusted on its own.
          type: string
        code:
          default: null
          type:
            - string
            - 'null'
        code_verifier:
          default: null
          type:
            - string
            - 'null'
        device_code:
          default: null
          type:
            - string
            - 'null'
        grant_type:
          default: ''
          description: '`authorization_code`, `refresh_token` or [`DEVICE_GRANT_TYPE`].'
          type: string
        redirect_uri:
          default: null
          type:
            - string
            - 'null'
        refresh_token:
          default: null
          type:
            - string
            - 'null'
      type: object
    Output_TokenResponse:
      description: RFC 6749 §5.1. Both token values are plaintext and exist only here.
      properties:
        access_token:
          type: string
        expires_in:
          description: The access token's remaining lifetime, in **seconds**.
          format: int64
          type: integer
        refresh_token:
          description: >-
            Rotated on every exchange: the one presented is consumed and this
            one

            replaces it. Presenting a consumed refresh token revokes the whole

            grant — see [`crate::operations::issuer`].
          type: string
        scope:
          description: >-
            The granted scopes, space-delimited, as they are recorded on the
            grant.
          type: string
        token_type:
          description: Always [`TOKEN_TYPE`].
          type: string
      required:
        - access_token
        - token_type
        - expires_in
        - refresh_token
        - scope
      type: object
    Output_OAuthErrorBody:
      description: RFC 6749 §5.2's error body, which RFC 7009 and RFC 8628 reuse.
      properties:
        error:
          type: string
        error_description:
          type: string
      required:
        - error
        - error_description
      type: object
  securitySchemes:
    bearer:
      scheme: bearer
      type: http
    anthropicKey:
      in: header
      name: x-api-key
      type: apiKey
    googleKey:
      in: header
      name: x-goog-api-key
      type: apiKey
    queryKey:
      in: query
      name: key
      type: apiKey

````

## Related topics

- [POST /v1/oauth/revoke](https://gproxy.leenhawk.com/api-reference/oauth/post-v1oauthrevoke.md)
- [POST /v1/oauth/authorize](https://gproxy.leenhawk.com/api-reference/oauth/post-v1oauthauthorize.md)
- [POST /v1/oauth/device/code](https://gproxy.leenhawk.com/api-reference/oauth/post-v1oauthdevicecode.md)
- [POST /v1/messages/count_tokens](https://gproxy.leenhawk.com/api-reference/forwarding/post-v1messagescount_tokens.md)
- [POST /v1/responses/input_tokens](https://gproxy.leenhawk.com/api-reference/forwarding/post-v1responsesinput_tokens.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.