> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semicola.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Token endpoint: authorization code (PKCE) or refresh token



## OpenAPI

````yaml /openapi/v3.yaml post /auth/token
openapi: 3.1.0
info:
  title: Semicola Exchange platform API
  version: 3.0.0-preview
  description: >-
    Platform endpoints of Semicola: sign-in, signup and OAuth for MCP clients,
    accounts, members and keys, billing, notifications, the Semi assistant (chat
    stream, confirmations, conversations), the MCP App widget host and realtime
    feeds. Typed agent tools live on the MCP server at /mcp/v3.
servers:
  - url: https://api.semicola.com
security:
  - bearerAuth: []
  - sessionCookie: []
tags:
  - name: Auth
  - name: Signup
  - name: OAuth
  - name: Accounts
  - name: Members
  - name: API Keys
  - name: Connected Apps
  - name: Onboarding
  - name: Billing
  - name: AI Usage
  - name: Notifications
  - name: Assistant
  - name: MCP Apps
  - name: Realtime
  - name: Demo
paths:
  /auth/token:
    post:
      tags:
        - OAuth
      summary: 'Token endpoint: authorization code (PKCE) or refresh token'
      operationId: postAuthToken
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                grant_type:
                  type: string
                  enum:
                    - authorization_code
                    - refresh_token
                client_id:
                  type: string
                  minLength: 1
                code:
                  description: authorization_code grant
                  type: string
                code_verifier:
                  description: PKCE verifier (authorization_code grant)
                  type: string
                redirect_uri:
                  type: string
                refresh_token:
                  description: refresh_token grant; rotates on every use
                  type: string
                resource:
                  type: string
              required:
                - grant_type
                - client_id
          application/json:
            schema:
              type: object
              properties:
                grant_type:
                  type: string
                  enum:
                    - authorization_code
                    - refresh_token
                client_id:
                  type: string
                  minLength: 1
                code:
                  description: authorization_code grant
                  type: string
                code_verifier:
                  description: PKCE verifier (authorization_code grant)
                  type: string
                redirect_uri:
                  type: string
                refresh_token:
                  description: refresh_token grant; rotates on every use
                  type: string
                resource:
                  type: string
              required:
                - grant_type
                - client_id
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                type: object
                properties:
                  access_token:
                    type: string
                  token_type:
                    type: string
                    const: Bearer
                  expires_in:
                    type: integer
                    minimum: -9007199254740991
                    maximum: 9007199254740991
                  refresh_token:
                    type: string
                  scope:
                    type: string
                required:
                  - access_token
                  - token_type
                  - expires_in
                  - refresh_token
                  - scope
                additionalProperties: false
        default:
          description: Error
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                  error_description:
                    type: string
                required:
                  - error
                additionalProperties: false
      security: []
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      description: API key or OAuth access token.
    sessionCookie:
      type: apiKey
      in: cookie
      name: sc_session

````