---
title: "Generate an access token"
description: "Exchanges a Call AI authorization code for a bearer access token and a refresh token."
contentType: "api-reference"
url: "https://developer.mindtickle.com/docs/call-ai/authentication/generate-an-access-token/"
---

## Prerequisites

1. [Authentication](/docs/call-ai/authentication/): Client credentials and the authentication base URL from Mindtickle Support.
2. [Get an authorization code](/docs/call-ai/authentication/get-an-authorization-code/): The authorization code, which expires 10 minutes after it is issued.

## Endpoint

```http
POST /token
```

Base URL: the authentication base URL Mindtickle Support provides for issuing tokens.

Headers: `Content-Type: application/json`.

## Request

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `client_id` | string | Not specified | Your unique client identifier. |
| `client_secret` | string | Not specified | Your client secret. |
| `grant_type` | string | Required | Must be set to `authorization_code` for this step. |
| `code` | string | Required | The authorization code returned by the authorization grant call. |

### Request example

```json
{
  "client_id": "CLIENT_ID",
  "client_secret": "CLIENT_SECRET",
  "grant_type": "authorization_code",
  "code": "AUTHORIZATION_CODE"
}
```

## Response

| Field | Type | Description |
| --- | --- | --- |
| `status` | number | Status code in the response body. Check the HTTP status separately. |
| `access_token` | string | The bearer token to send with Call AI requests. |
| `refresh_token` | string | The token used to regenerate an access token. |
| `token_type` | string | The token type, `Bearer`. |
| `expires_in` | Not specified | Time until the access token expires. Confirm the value type and unit with [Mindtickle Support](mailto:support@mindtickle.com) before using this field to schedule token renewal. |

### Response example

Token values and `EXPIRES_IN` are placeholders. Do not infer the type or unit of `expires_in` from this example.

```json
{
  "status": 200,
  "access_token": "ACCESS_TOKEN",
  "refresh_token": "REFRESH_TOKEN",
  "token_type": "Bearer",
  "expires_in": "EXPIRES_IN"
}
```

## Notes

- **Limits:** `access_token` is valid for 1 day. `refresh_token` is valid for 365 days.
- **Expiration behavior:** An expired token can appear as an authentication error inside the GraphQL `errors` array, even when the HTTP status is 200. Check the [token-expiration error](/docs/call-ai/graphql-api/#error-handling), then [refresh the access token](/docs/call-ai/authentication/refresh-an-access-token/).

## Related

- [Refresh an access token](/docs/call-ai/authentication/refresh-an-access-token/): Regenerate the access token when it expires.
- [Validate a token](/docs/call-ai/authentication/validate-a-token/): Check the user and client details tied to the token.
- [GraphQL API](/docs/call-ai/graphql-api/): Pass the token in the header of your GraphQL requests.