> ## Documentation Index
> Fetch the complete documentation index at: https://docs.member.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Oauth Token

> OAuth2 Token Endpoint (RFC 6749 §3.2).

Accepts application/x-www-form-urlencoded. Supported grant types:
  - authorization_code: requires code, redirect_uri, code_verifier, client_id.
    Confidential clients must also present client_secret_basic.
  - refresh_token: requires refresh_token, client_id.
    Confidential clients must present client_secret_basic.

This is an OAuth2/OIDC standard endpoint — NOT JSON:API.
Errors are plain OAuth JSON ({"error": ..., "error_description": ...}).

SECURITY: rate-limited at the dependency level; client auth is enforced
inside TokenService per §4.3 requirements.



## OpenAPI

````yaml /openapi/mio-openapi.json post /oauth/token
openapi: 3.1.0
info:
  description: >-
    Production API reference for Membership.io. Use the authored guides for
    workflows and the generated endpoint pages for exact parameters and schemas.
  title: Membership.io API
  version: 0.1.0
servers:
  - description: Production
    url: https://api.member.dev
security:
  - bearerAuth: []
paths:
  /oauth/token:
    post:
      tags:
        - oauth
      summary: Oauth Token
      description: |-
        OAuth2 Token Endpoint (RFC 6749 §3.2).

        Accepts application/x-www-form-urlencoded. Supported grant types:
          - authorization_code: requires code, redirect_uri, code_verifier, client_id.
            Confidential clients must also present client_secret_basic.
          - refresh_token: requires refresh_token, client_id.
            Confidential clients must present client_secret_basic.

        This is an OAuth2/OIDC standard endpoint — NOT JSON:API.
        Errors are plain OAuth JSON ({"error": ..., "error_description": ...}).

        SECURITY: rate-limited at the dependency level; client auth is enforced
        inside TokenService per §4.3 requirements.
      operationId: oauth.post_oauth_post_oauth_token
      parameters:
        - in: query
          name: grant_type
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Grant Type
      responses:
        '200':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/OAuthTokenResponse'
          description: Successful Response
        '422':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
components:
  schemas:
    OAuthTokenResponse:
      description: >-
        Token endpoint success response (RFC 6749 §4.1.4 + OIDC §3.1.3.3).


        ``scope`` is the space-delimited set of granted scopes (RFC 6749 §5.1).
        On a

        refresh the originally granted scope is carried forward verbatim — never

        widened.
      properties:
        access_token:
          title: Access Token
          type: string
        expires_in:
          title: Expires In
          type: integer
        id_token:
          title: Id Token
          type: string
        refresh_token:
          anyOf:
            - type: string
            - type: 'null'
          title: Refresh Token
        scope:
          title: Scope
          type: string
        token_type:
          default: Bearer
          title: Token Type
          type: string
      required:
        - access_token
        - id_token
        - expires_in
        - scope
      title: OAuthTokenResponse
      type: object
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          title: Detail
          type: array
      title: HTTPValidationError
      type: object
    ValidationError:
      properties:
        ctx:
          title: Context
          type: object
        input:
          title: Input
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          title: Location
          type: array
        msg:
          title: Message
          type: string
        type:
          title: Error Type
          type: string
      required:
        - loc
        - msg
        - type
      title: ValidationError
      type: object
  securitySchemes:
    bearerAuth:
      bearerFormat: JWT or mio_sk API key
      description: >-
        Send platform JWTs, contact JWTs, or team API keys as `Authorization:
        Bearer <token>`.
      scheme: bearer
      type: http

````