> ## Documentation Index
> Fetch the complete documentation index at: https://dev.nimbo-x.com/llms.txt
> Use this file to discover all available pages before exploring further.

# POST /oauth/token

> Exchanges approved account credentials or a refresh token for integration tokens. Use the returned expires_in value. Accounts requiring two-factor authentication can return a 403 challenge instead of access tokens.



## OpenAPI

````yaml /openapi/nimbo_api.yml post /oauth/token
openapi: 3.0.0
info:
  title: Nimbo API
  version: 1.0.0
  description: >-
    Nimbo API reference. Use the API host and integration access provided by
    Nimbo.
servers:
  - url: https://api.example.test
    description: Reference only; confirm your integration host with Nimbo
security: []
paths:
  /oauth/token:
    post:
      tags:
        - Authentication
      summary: POST /oauth/token
      description: >-
        Exchanges approved account credentials or a refresh token for
        integration tokens. Use the returned expires_in value. Accounts
        requiring two-factor authentication can return a 403 challenge instead
        of access tokens.
      operationId: legacy_nimbo_api_post__oauth_token
      parameters: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              oneOf:
                - type: object
                  required:
                    - grant_type
                    - username
                    - password
                  properties:
                    grant_type:
                      type: string
                      enum:
                        - password
                    username:
                      type: string
                      description: Account email address.
                    password:
                      type: string
                      format: password
                - type: object
                  required:
                    - grant_type
                    - refresh_token
                  properties:
                    grant_type:
                      type: string
                      enum:
                        - refresh_token
                    refresh_token:
                      type: string
                      description: Refresh token from a successful token response.
          multipart/form-data:
            schema:
              oneOf:
                - type: object
                  required:
                    - grant_type
                    - username
                    - password
                  properties:
                    grant_type:
                      type: string
                      enum:
                        - password
                    username:
                      type: string
                      description: Account email address.
                    password:
                      type: string
                      format: password
                - type: object
                  required:
                    - grant_type
                    - refresh_token
                  properties:
                    grant_type:
                      type: string
                      enum:
                        - refresh_token
                    refresh_token:
                      type: string
                      description: Refresh token from a successful token response.
      responses:
        '200':
          content:
            application/json:
              schema:
                type: object
                properties:
                  access_token:
                    type: string
                  token_type:
                    type: string
                  expires_in:
                    type: integer
                  refresh_token:
                    type: string
                  created_at:
                    type: integer
          description: Successful response
        '403':
          description: >-
            Authentication can require an additional verification step. A
            two-factor challenge includes token_type set to 2fa, expires_in, and
            otp. Confirm the supported account authentication flow with Nimbo.
      security: []

````