# Create an OAuth token

Exchange credentials or authorisation grants for an OAuth 2.0 access token.
The `grant_type` field determines which parameters are required and which response fields are returned.
See [managing token expiration](/api-reference/oauth-token#managing-token-expiration) for guidance on refreshing tokens before they expire.

Endpoint: POST /oauth/token
Security: BasicAuth

## Header parameters:

  - `X-External-Correlation-Id` (string)
    Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. [Learn more](/guides/developer/headers/correlation-id).

## Request fields (application/x-www-form-urlencoded):

  - `grant_type` (string, required)
    OAuth 2.0 grant type.
    Enum: "client_credentials"

  - `client_id` (string, required)
    Your API client ID.

  - `email` (string, required)
    The email address of the user being registered.

  - `registration_code` (string, required)
    Registration code obtained when creating the user via `POST /v1/user/signup/registration_code`.

  - `code` (string, required)
    Authorisation code provided upon redirect back from the authorisation flow.

  - `redirect_uri` (string, required)
    Registered redirect URL coordinated with Wise during onboarding.
    Example: https://www.yourapp.com

  - `refresh_token` (string, required)
    Refresh token obtained from a `registration_code` or `authorization_code` grant.

## Response 200 fields (application/json):

  - `access_token` (string)
    Access token to be used when calling the API. Valid for 12 hours.
    Example: 01234567-89ab-cdef-0123-456789abcdef

  - `token_type` (string)
    Type of the token.
    Example: bearer

  - `refresh_token` (string)
    Refresh token used to obtain new user access tokens without requiring the user to re-authorise. Valid for up to 20 years.
Only returned for user access token grant types (`registration_code`, `authorization_code`, `refresh_token`).
    Example: 01234567-89ab-cdef-0123-456789abcdef

  - `expires_in` (integer)
    Access token expiry time in seconds.
    Example: 43199

  - `expires_at` (string)
    Access token expiration timestamp (UTC).
    Example: 2025-04-11T03:43:28.148Z

  - `refresh_token_expires_in` (integer)
    Refresh token expiry time in seconds.
Only returned for user access token grant types (`registration_code`, `authorization_code`, `refresh_token`).
    Example: 628639555

  - `refresh_token_expires_at` (string)
    Refresh token expiration timestamp (UTC).
Only returned for user access token grant types (`registration_code`, `authorization_code`, `refresh_token`).
    Example: 2045-03-12T13:49:23.552Z

  - `scope` (string)
    Scope of the token.
    Example: transfers

  - `created_at` (string)
    Token creation time in ISO 8601 format.
Only returned for user access token grant types (`registration_code`, `authorization_code`, `refresh_token`).
    Example: 2020-01-01T12:33:33.12345Z

## Response 400 fields (application/json):

  - `error` (string)
    Example: invalid_request

  - `error_description` (string)
    Example: Missing grant type

## Response 401 fields (application/json):

  - `error` (string)
    Example: invalid_grant

  - `error_description` (string)
    Example: Invalid user credentials.