# Exchange an authorization code, device code, or refresh token (/reference/oauth-token)

Use HTTP Basic client authentication when possible. client_secret_post remains supported for compatibility. Public device clients send client_id without a secret. Repeated parameters and multiple client authentication methods are rejected.

Full request/response schemas for this operation: https://docs.eprospera.com/openapi.yaml

Use HTTP Basic client authentication when possible. client_secret_post remains supported for compatibility. Public device clients send client_id without a secret. Repeated parameters and multiple client authentication methods are rejected.