# Create an access token

`POST /oauth2/token`

API version: `v2026.07.00`. Send `X-Moov-Version: v2026.07.00` to get the behavior described here.

> AI agents: search and read all Moov docs with the docs MCP server at https://docs.moov.io/mcp (no API key). Setup: https://docs.moov.io/guides/developer-tools/mcp-ai/docs-mcp/index.md

Create or refresh an access token.

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `X-Moov-Version` | header | string |  | Set this header to v2026.07.00 to use the API described in this specification. When omitted, the server defaults to v2024.01.00, the earliest supported version, which may not match the behavior documented here. An unrecognized well-formed version uses the latest supported version that is not newer than the requested version, when one exists. For example, `v2026.08.00` uses `v2026.07.00`. A malformed value, such as `2022`, returns a `404` response. Values: `v2026.07.00`. |

## Request body

Content type: `application/json`

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `grant_type` | string | Yes | The type of grant being requested. - `client_credentials`: A grant type used by clients to obtain an access token - `refresh_token`: A grant type used by clients to obtain a new access token using a refresh token Values: `client_credentials`, `refresh_token`. |
| `client_id` | string |  | Client ID can be provided here in the body, or as the Username in HTTP Basic Auth. |
| `client_secret` | string |  | Client secret can be provided here in the body, or as the Password in HTTP Basic Auth. |
| `scope` | string |  | A space delimited list of scopes. Required when `grant_type` is `client_credentials`. |
| `refresh_token` | string |  | The refresh_token returned alongside the access token being refreshed. Required when `grant_type` is `refresh_token`. |
| `client_type` | string |  | The client type requesting a token. `device` and `service` clients do not require browser origin binding. Defaults to `web` when omitted. This field applies to the `client_credentials` grant; refreshed tokens keep the original client type. Values: `web`, `device`, `service`, `w`, `d`, `s`. |

## Response 200

The request completed successfully.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `token_type` | string | Yes | An [RFC 6750](https://www.rfc-editor.org/rfc/rfc6750#section-6.1) token type. Values: `Bearer`. |
| `access_token` | string | Yes | A value passed to the authorization server to gain access to the system. |
| `refresh_token` | string | Yes | A value passed to the authorization server to obtain a new access token. |
| `expires_in` | integer (int32) | Yes | Unix timestamp indicating when this token expires. |
| `scope` | string | Yes | A space-delimited list of [scopes](https://docs.moov.io/api/authentication/scopes/) that are allowed. |

## Errors

| Status | Meaning |
| --- | --- |
| 400 | The server could not understand the request due to invalid syntax. |
| 422 | The request was well-formed, but the contents failed validation. Check the request for missing or invalid fields. |
| 429 | Request was refused due to rate limiting. |
| 500 | The request failed due to an unexpected error. |
| 504 | The request failed because a downstream service failed to respond. |

## Examples

### cURL

```bash
curl -X POST "https://api.moov.io/oauth2/token" \
  -H "Authorization: Bearer {token}" \
  -H "X-Moov-Version: v2026.07.00" \
  -d '{
  "grant_type": "client_credentials"
}'
```

### Typescript (SDK)

```typescript
import { Moov } from "@moovio/sdk";

const moov = new Moov({
  security: {
    username: "",
    password: "",
  },
});

async function run() {
  const result = await moov.authentication.createAccessToken({
    grantType: "client_credentials",
    clientId: "5clTR_MdVrrkgxw2",
    clientSecret: "dNC-hg7sVm22jc3g_Eogtyu0_1Mqh_4-",
    scope: "/accounts.read /accounts.write",
    refreshToken: "eyJhbGc0eSI6TQSIsImN0kpXVCIsImtp6IkpXVsImtpZC0a...",
  });

  console.log(result);
}

run();
```

Full reference with SDK examples in every language: https://docs.moov.io/api/authentication/access-tokens/create/