---
title: Exchange a grant for tokens
description: "RFC 6749 §3.2 token endpoint. Supports the device code grant (RFC 8628) and the refresh token grant. Authenticated by the fixed confidential device-flow clie…"
product: general
lang: en
last_updated: 2026-09-15
token_estimate: 1403
---
# Exchange a grant for tokens

> For AI agents: a documentation index is available at [/docs/llms.txt](/docs/llms.txt). Append `.md` to any page URL for markdown, or send `Accept: text/markdown`.

## Exchange a grant for tokens

**POST** `/v1/auth/token`

Full URL: `https://developer-api.amplitude.com/v1/auth/token`

**Servers:**
- Production (US): `https://developer-api.amplitude.com/v1/auth/token`
- Production (EU): `https://developer-api.eu.amplitude.com/v1/auth/token`

Exchange a grant for tokens

RFC 6749 §3.2 token endpoint. Supports the `device_code` grant (RFC 8628) and the `refresh_token` grant. Authenticated by the fixed confidential device-flow client (injected server-side). Does not require a Bearer token.

## Body (application/json)

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| grant_type | string | Yes | — | The OAuth grant type. Must be `urn:ietf:params:oauth:grant-type:device_code`. |
| device_code | string | No | — | The device_code from the device-authorization response. |
| refresh_token | string | No | — | The refresh_token issued by a previous token or refresh grant. |

## Body (application/x-www-form-urlencoded)

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| grant_type | string | Yes | — | The OAuth grant type. Must be `urn:ietf:params:oauth:grant-type:device_code`. |
| device_code | string | No | — | The device_code from the device-authorization response. |
| refresh_token | string | No | — | The refresh_token issued by a previous token or refresh grant. |

## Response (application/json)

**200** — Tokens issued.

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| access_token | string | Yes | — | — |
| token_type | string | Yes | — | — |
| expires_in | integer | Yes | — | — |
| refresh_token | string | No | — | — |
| scope | string | No | — | — |
| id_token | string | No | — | — |

```json
{
  "access_token": "string",
  "token_type": "string",
  "expires_in": 0,
  "refresh_token": "string",
  "scope": "string",
  "id_token": "string"
}
```

**400** — Invalid or unsupported grant (RFC 6749 §5.2 OAuth error).

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| error | string | Yes | — | — |
| error_description | string | No | — | — |
| error_hint | string | No | — | — |
| error_uri | string | No | — | — |

```json
{
  "error": "string",
  "error_description": "string",
  "error_hint": "string",
  "error_uri": "string"
}
```

**401** — Client authentication failed (RFC 6749 §5.2 OAuth error).

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| error | string | Yes | — | — |
| error_description | string | No | — | — |
| error_hint | string | No | — | — |
| error_uri | string | No | — | — |

```json
{
  "error": "string",
  "error_description": "string",
  "error_hint": "string",
  "error_uri": "string"
}
```

**429**

**500** — Server error (RFC 6749 §5.2 OAuth error).

| Name | Type | Required | Default | Description |
| --- | --- | --- | --- | --- |
| error | string | Yes | — | — |
| error_description | string | No | — | — |
| error_hint | string | No | — | — |
| error_uri | string | No | — | — |

```json
{
  "error": "string",
  "error_description": "string",
  "error_hint": "string",
  "error_uri": "string"
}
```

## Code samples

### cURL

```bash
curl -X POST "https://developer-api.amplitude.com/v1/auth/token" \
  -H "Content-Type: application/json" \
  -H "Authorization: YOUR_API_KEY"
```

### Python

```python
import requests

response = requests.post(
    "https://developer-api.amplitude.com/v1/auth/token",
    headers={
        "Content-Type": "application/json",
        "Authorization": "YOUR_API_KEY"
    }
)
data = response.json()
```

### JavaScript

```javascript
const response = await fetch("https://developer-api.amplitude.com/v1/auth/token", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "Authorization": "YOUR_API_KEY"
  }
});
const data = await response.json();
```

### PHP

```php
<?php
$ch = curl_init("https://developer-api.amplitude.com/v1/auth/token");
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, "POST");
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Content-Type: application/json",
    "Authorization: YOUR_API_KEY"
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
```

### Go

```go
package main

import (
  "bytes"
  "net/http"
)

func main() {
req, _ := http.NewRequest("POST", "https://developer-api.amplitude.com/v1/auth/token", nil)
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Authorization", "YOUR_API_KEY")
  client := &http.Client{}
  resp, _ := client.Do(req)
  defer resp.Body.Close()
}
```

### Java

```java
HttpClient client = HttpClient.newHttpClient();
HttpRequest request = HttpRequest.newBuilder()
      .uri(URI.create("https://developer-api.amplitude.com/v1/auth/token"))
      .method("POST", HttpRequest.BodyPublishers.noBody())
.header("Content-Type", "application/json")
      .header("Authorization", "YOUR_API_KEY")
      .build();
HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
```

### Ruby

```ruby
require "net/http"
require "json"

uri = URI("https://developer-api.amplitude.com/v1/auth/token")
request = Net::HTTP::Post.new(uri)
request["Content-Type"] = "application/json"
request["Authorization"] = "YOUR_API_KEY"
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") do |http|
  http.request(request)
end
```