---
"@context": https://schema.org
"@type": TechArticle
"@id": https://www.twilio.com/docs/iam/oauth-apps/oauth-access-token#article
headline: OAuth Token API
description: Learn how to use the Twilio OAuth Token API endpoint to generate access tokens with an OAuth app's Client ID and Client Secret, then call Twilio APIs with them.
url: https://www.twilio.com/docs/iam/oauth-apps/oauth-access-token
inLanguage: en
dateModified: 2026-08-13T17:05:12.000Z
author:
  "@type": Organization
  name: Twilio Developer Education Team
publisher:
  "@type": Organization
  name: Twilio
---

# OAuth Token API

Access Tokens can be generated by calling the Token API endpoint with the right set of parameters and values. The request differs between Client Credentials and Authorization Code OAuth apps.

## Client Credentials Access Token request

`POST https://oauth.twilio.com/v2/token`

**Encoding type**:`application/x-www-form-urlencoded`

#### Request body parameters

| Parameter       | Type   | Required | Description                                           |
| --------------- | ------ | -------- | ----------------------------------------------------- |
| `client_id`     | string | yes      | The unique identifier of an OAuth app                 |
| `client_secret` | string | yes      | The confidential secret associated with the client ID |
| `grant_type`    | string | yes      | Specify the OAuth grant type as `client_credentials`  |

#### cURL Request

```bash
curl --location 'https://oauth.twilio.com/v2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id={CLIENT_ID}' \
--data-urlencode 'client_secret={CLIENT_SECRET}' \
--data-urlencode 'grant_type=client_credentials'
```

#### Success response

**Status**: `200 OK`

**Body (JSON)**:

```json
{
    "access_token": "{ACCESS_TOKEN}",
    "id_token": null,
    "token_type": "Bearer",
    "expires_in": 3600,
    "refresh_token": null
}
```

**Response Fields**

| Parameter      | Type    | Description                                         |
| -------------- | ------- | --------------------------------------------------- |
| `access_token` | string  | The Access Token issued by the authorization server |
| `token_type`   | string  | The type of token (typically `Bearer`)              |
| `expires_in`   | integer | The token lifetime in seconds                       |

## Authorization code access token request

`POST https://oauth.twilio.com/v2/token`

**Encoding type**:`application/x-www-form-urlencoded`

#### Request body parameters

| Parameter       | Type   | Required | Description                                           |
| --------------- | ------ | -------- | ----------------------------------------------------- |
| `client_id`     | string | yes      | The unique identifier of an OAuth app                 |
| `client_secret` | string | yes      | The confidential secret associated with the client ID |
| `grant_type`    | string | yes      | Specify the OAuth grant type as `authorization_code`  |
| `code`          | string | yes      | Authorization code generated after consent            |
| `redirect_uri`  | string | yes      | The redirect URL of the OAuth app                     |

#### cURL Request

```bash
curl --location 'https://oauth.twilio.com/v2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id={CLIENT_ID}' \
--data-urlencode 'client_secret={CLIENT_SECRET}' \
--data-urlencode 'grant_type=authorization_code' \
--data-urlencode 'code=AUTHORIZATION_CODE' \
--data-urlencode 'redirect_uri={REDIRECT_URL}'
```

#### Success response

**Status**: `200 OK`

**Body(JSON)**:

```json
{
    "access_token": "{ACCESS_TOKEN}",
    "id_token": null,
    "token_type": "Bearer",
    "expires_in": 3600,
    "refresh_token": "{REFRESH_TOKEN}"
}
```

**Response Fields**

| Parameter       | Type    | Description                                          |
| --------------- | ------- | ---------------------------------------------------- |
| `access_token`  | string  | The Access Token issued by the authorization server  |
| `token_type`    | string  | The type of token (typically `Bearer`)               |
| `expires_in`    | integer | The token lifetime in seconds                        |
| `refresh_token` | string  | The Refresh Token issued by the authorization server |

## Authorization Code Access Token request using Refresh Token

When the access token expires, use the refresh token to obtain a new access token without prompting the user to re-authorize.

`POST https://oauth.twilio.com/v2/token`

**Encoding type**:`application/x-www-form-urlencoded`

#### Request body parameters

| Parameter       | Type   | Required | Description                                           |
| --------------- | ------ | -------- | ----------------------------------------------------- |
| `client_id`     | string | yes      | The unique identifier of an OAuth app                 |
| `client_secret` | string | yes      | The confidential secret associated with the client ID |
| `grant_type`    | string | yes      | Specify the OAuth grant type as `refresh_token`       |
| `refresh_token` | string | yes      | The Refresh Token issued by the authorization server  |

#### cURL Request

```bash
curl --location 'https://oauth.twilio.com/v2/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'client_id={CLIENT_ID}' \
--data-urlencode 'client_secret={CLIENT_SECRET}' \
--data-urlencode 'grant_type=refresh_token' \
--data-urlencode 'refresh_token={REFRESH_TOKEN}'
```

#### Success response

**Status**: `200 OK`

**Body(JSON)**:

```json
{
    "access_token": "{ACCESS_TOKEN}",
    "id_token": null,
    "token_type": "Bearer",
    "expires_in": 3600,
    "refresh_token": "{REFRESH_TOKEN}"
}
```

**Response Fields**

| Parameter       | Type    | Description                                          |
| --------------- | ------- | ---------------------------------------------------- |
| `access_token`  | string  | The Access Token issued by the authorization server  |
| `token_type`    | string  | The type of token (typically `Bearer`)               |
| `expires_in`    | integer | The token lifetime in seconds                        |
| `refresh_token` | string  | The Refresh Token issued by the authorization server |

## API resource call examples

Pass the `access_token` returned by the Token API as a Bearer token in the `Authorization` header of your Twilio API requests.

**cURL example: list Messages for an account**

```bash
curl --location 'https://api.twilio.com/2010-04-01/Accounts/<AccountSID>/Messages.json' \
--header 'Authorization: Bearer {AccessToken}'
```

## Server-side SDK support

OAuth support for Twilio APIs is available in all server-side SDKs. Here are details of the versions and examples:

* Java SDK version 10.6.0 and above:
  * [README](https://github.com/twilio/twilio-java/blob/main/README.md)
  * [Public OAuth example](https://github.com/twilio/twilio-java/blob/main/examples/PublicOAuthExample.md).
* C# SDK version 7.6.0 and above:
  * [README](https://github.com/twilio/twilio-csharp/blob/main/README.md)
  * [Public OAuth example](https://github.com/twilio/twilio-csharp/blob/main/examples/PublicOAuthAuthentication.md).
* Node SDK version 5.4.0 and above:
  * [README](https://github.com/twilio/twilio-node/blob/main/README.md)
  * [Public OAuth example](https://github.com/twilio/twilio-node/blob/main/examples/public_oauth.js).
* Python SDK version 9.4.1 and above:
  * [README](https://github.com/twilio/twilio-python/blob/main/README.md)
  * [Public OAuth example](https://github.com/twilio/twilio-python/blob/main/examples/public_oauth.py).
* Ruby SDK version 7.4.0 and above:
  * [README](https://github.com/twilio/twilio-ruby/blob/main/README.md)
  * [Public OAuth example](https://github.com/twilio/twilio-ruby/blob/main/examples/public_oauth.rb).
* PHP SDK version 8.5.0 and above:
  * [README](https://github.com/twilio/twilio-php/blob/main/README.md)
  * [Public OAuth example](https://github.com/twilio/twilio-php/blob/main/example/public_oauth_example.php).
* Go SDK version 1.25.1 and above:
  * [README](https://github.com/twilio/twilio-go/blob/main/README.md)
  * [Public OAuth example](https://github.com/twilio/twilio-go/blob/main/advanced-examples/public-oauth.md).