> This page is for Developer Documentation.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.benchling.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.benchling.com/_mcp/server.

# Generate a token

POST https://{tenant_name}.benchling.com/oauth/token
Content-Type: application/x-www-form-urlencoded

Generate a token for usage with authenticating via OAuth2 in subsequent API calls.

Supports the following grant types:
- `client_credentials` — exchange client ID and secret for an access token.
- `authorization_code` — exchange an authorization code (from the OAuth2 authorize flow) for an access token and refresh token. Requires `code`, `redirect_uri`, and optionally `code_verifier` (for PKCE) and `state`.
- `refresh_token` — exchange a refresh token for a new access token and refresh token.

**Note:** This endpoint is available at the absolute URL `/oauth/token` (not relative to the versioned API base path).

Reference: https://docs.benchling.com/docs/api/benchling-api/authentication/get-token

## Request

### Body (application/x-www-form-urlencoded)

This endpoint expects an object.

- `grant_type` (enum, required)
  - Allowed values: `client_credentials`, `authorization_code`, `refresh_token`
- `client_id` (string, optional) — ID of client to request token for. Leave off if client ID and secret are being supplied through Authorization header.
- `client_secret` (string, optional) — Leave off if client ID and secret are being supplied through Authorization header.
- `code` (string, optional) — Authorization code received from the authorize endpoint. Required when grant_type is authorization_code.
- `code_verifier` (string, optional) — PKCE code verifier. Required when grant_type is authorization_code and a code_challenge was sent in the authorization request.
- `redirect_uri` (string, optional) — Redirect URI that was used in the authorization request. Required when grant_type is authorization_code.
- `refresh_token` (string, optional) — Refresh token to exchange for a new access token. Required when grant_type is refresh_token.
- `state` (string, optional) — Optional state parameter for the authorization_code grant type.

## Response

### 200

Generated token

- `access_token` (string, required)
- `expires_in` (integer, required) — Number of seconds that the access token is valid for
- `token_type` (enum, required)
  - Allowed values: `Bearer`
- `refresh_token` (string, optional) — Refresh token. Returned when grant_type is authorization_code or refresh_token.
- `refresh_token_expires_in` (integer, optional) — Number of seconds that the refresh token is valid for. Returned when a refresh_token is included in the response.

## Errors

### 400 Get Token OAuth Request Bad Request Error

Bad Request

- `any`

### 401 Get Token OAuth Request Unauthorized Error

Unauthorized

- `any`

## Examples

**Request**

```json
{
  "grant_type": "client_credentials"
}
```

**Response**

```json
{
  "access_token": "eyJ...",
  "expires_in": 900,
  "token_type": "Bearer",
  "refresh_token": "eyJ...",
  "refresh_token_expires_in": 2592000
}
```

**SDK Code**

```python
import requests

url = "https://{tenant_name}.benchling.com/oauth/token"

payload = ""
headers = {"Content-Type": "application/x-www-form-urlencoded"}

response = requests.post(url, data=payload, headers=headers)

print(response.json())
```

```javascript
const url = 'https://{tenant_name}.benchling.com/oauth/token';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/x-www-form-urlencoded'},
  body: new URLSearchParams('')
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```