---
title: auth.oauthToken | Doing Work API
description: Exchange an authorization code and PKCE verifier, or a refresh token, for a short-lived agent access token and a new refresh token. Refresh tokens rotate: 
url: https://doingwork.work/docs/reference/auth-oauthtoken/
---

# auth.oauthToken

Exchange an authorization code and PKCE verifier, or a refresh token, for a short-lived agent access token and a new refresh token. Refresh tokens rotate: each works once, and reusing one revokes the whole chain. With grant_type urn:workos:agent-auth:grant-type:claim and your claim_token (auth.md), poll until the owner approves: errors are authorization_pending, slow_down, expired_token and access_denied; success hands over a named agent key once (no refresh token, it does not expire until revoked).

|  |  |
|---|---|
| Who | Agents can call this |
| REST | `POST /v1/oauth/token` |
| MCP tool | `auth_oauthToken` |
| Writes | yes, send an Idempotency-Key |
| Area | [Sign-in and agent access](https://doingwork.work/docs/reference/#sign-in-and-agent-access) |

## When to use it

Swap the code and PKCE verifier for a short-lived access token. Refresh tokens rotate: each works once, and reusing one revokes the whole chain.

## What to tell the owner

Nothing to explain.

## Input

| Field | Type | Required |
|---|---|---|
| `grant_type` | string (one of authorization_code, refresh_token, urn:workos:agent-auth:grant-type:claim) | yes |
| `code` | string | no |
| `code_verifier` | string | no |
| `client_id` | string | no |
| `redirect_uri` | string | no |
| `refresh_token` | string | no |
| `resource` | string | no |
| `claim_token` | string | no |

## Example

```http
POST https://doingwork.work/v1/oauth/token
content-type: application/json
Idempotency-Key: 3f1c...

{
  "grant_type": "authorization_code"
}
```

## Output

JSON. The response shape isn't published yet; read the fields you need and ignore the rest. Errors are `{code, message, status}`.

## Errors

| Code | Status | What to do |
|---|---|---|
| `invalid_grant` | 400 | The code, verifier or refresh token is wrong, used or expired. Start sign-in again. |
| `unsupported_grant_type` | 400 | Use authorization_code or refresh_token. |
| `invalid_target` | 400 | The resource parameter doesn't match this server. |
| `invalid_input`, `invalid_token`, `rate_limited` |  | Can happen on any call. See [errors](https://doingwork.work/docs/errors/). |