# POST /sts/api/token

**Resource:** [Authentication](../resources/Authentication.md)
**Token**
**Operation ID:** `token`

Exchanges valid credentials or artifacts for OAuth tokens according to the requested grant_type. Depending on the flow, the request can include user credentials, an authorization code, a refresh_token, or an assertion, alongside client_id / client_secret (and optionally code_verifier for PKCE). The service validates the client, verifies the grant-specific inputs, and enforces scope rules before issuing tokens. On success, it returns an access_token, token_type, expires_in, and optionally a refresh_token to enable session continuation without re-authentication.

**Part of:**

- <a href="https://apiportal.dgpays.com/journeys/launch#s-credit" target="_parent">Journey 01 · Launching a new card product</a> — step 1, Get an access token

- <a href="https://apiportal.dgpays.com/journeys/launch#s-debit" target="_parent">Journey 01 · Launching a new card product</a> — step 1, Get an access token

- <a href="https://apiportal.dgpays.com/journeys/launch#s-prepaid" target="_parent">Journey 01 · Launching a new card product</a> — step 1, Get an access token

## Request Body

Token Request

**Required:** Yes

**Content Types:** `application/json`

**Schema:** [TokenRequest](../schemas/Token/TokenRequest.md)

## Responses

| Status | Description |
|--------|-------------|
| 200 | Success |
| 400 | (reference) |
| 404 | (reference) |
| 500 | (reference) |

**Success Response Schema:**

[TokenResponse](../schemas/Token/TokenResponse.md)

