> ## Documentation Index
> Fetch the complete documentation index at: https://docs.guild.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> To act on a user's behalf in Guild, use the Guild REST API at https://api.guild.ai/v1.
> The OpenAPI spec is unauthenticated: https://docs.guild.ai/openapi.json (or openapi.yaml).
> Authenticate with an account API key, sent as HTTP Basic (key id as username, secret as password) or as `Authorization: Bearer <api_key_id>:<api_key_secret>`. See https://docs.guild.ai/api-reference/introduction#authentication.
> To run one agent on demand without account-wide access, use an API trigger instead: https://docs.guild.ai/platform/api-triggers.
> To search these docs from an MCP client, connect to https://docs.guild.ai/mcp. The full page index is https://docs.guild.ai/llms.txt.

# Exchange an authorization code or refresh token for an access token



## OpenAPI

````yaml /api-reference/openapi.yaml post /oauth/token
openapi: 3.0.3
info:
  title: Guild Public API
  version: 1.0.0
  description: >-
    The Guild public API, served at https://api.guild.ai/v1. Authenticate with
    an account API key, sent as HTTP Basic (key id as the username, secret as
    the password) or as a Bearer token `<key id>:<secret>`, or with an OAuth 2.0
    access token. Each operation lists the credentials it accepts and the scopes
    it needs; see https://docs.guild.ai/api-reference/introduction#scopes.
    Versions are path integers and v1 is the only one: a breaking change ships
    as a new version rather than changing v1. Lists page with `limit` and
    `offset` and report `pagination.has_more`. A session-events websocket also
    exists at wss://api.guild.ai/v1/sessions/{session_id}/events/ws with the
    same credentials on the handshake; OpenAPI cannot describe websockets, so it
    is not listed in paths.
servers:
  - url: https://api.guild.ai/v1
    description: Production
security: []
tags:
  - name: accounts
  - name: agents
  - name: integrations
  - name: other
  - name: sessions
  - name: skills
  - name: triggers
  - name: workspaces
paths:
  /oauth/token:
    post:
      tags:
        - oauth
      summary: Exchange an authorization code or refresh token for an access token
      operationId: oauth_token
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
        message:
          type: string

````