# Creating token with authorization code

**URL:** <https://devforum.okta.com/t/creating-token-with-authorization-code/10374>\
**Category:** Questions\
**Created:** [August 4, 2020, 8:20am UTC](https://devforum.okta.com/t/creating-token-with-authorization-code/10374 "2020-08-04T08:20:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![user-823402](https://avatars.discourse-cdn.com/v4/letter/u/e8c25b/32.png) [@user-823402](https://devforum.okta.com/u/user-823402)\
**Post date:** [August 4, 2020, 8:20am UTC](https://devforum.okta.com/t/creating-token-with-authorization-code/10374/1 "2020-08-04T08:20:55Z")

</div>

Hello,

I am new to Okta and want to create an access token for a user. Currently I am trying to do that with postman. My current steps are:

1. Calling the api/v1/authn endpoint =\> I receive the sessionToken
2. Calling the oauth2/v1/authorize endpoint with: client\_id, response\_type = code, response\_mode = query, scope = openid, redirect\_uri, state = some value, nonce = a guid, sessionToken = the received sessionToken =\> I receive the code in the location header
3. Calling the oauth2/default/v1/token endpoint with grant\_type = authorization\_code, code = the code from second call, redirect\_uri = same value as in 1. call and as authentication I use the clientId and secret (it is configured as web app in Okta menu). =\> The 3. Callc is everytime forbidden and I do not know why. Can somebody help me?

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [August 4, 2020, 3:10pm UTC](https://devforum.okta.com/t/creating-token-with-authorization-code/10374/2 "2020-08-04T15:10:12Z")

</div>

It looks like you’re having trouble with your request URLs.

For step 3, you must use the same issuer as used for your authorize request, just as you would for any other OAuth endpoints you are using (introspect, userinfo, revoke, etc). In step 2, you are using oauth2/v1/authorize, so in step 3, you should use oauth2/v1/token

---

<div class="post-metadata">

**Author:** ![vijet](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/vijet/32/245_2.png) [@vijet](https://devforum.okta.com/u/vijet)\
**Post date:** [August 4, 2020, 4:49pm UTC](https://devforum.okta.com/t/creating-token-with-authorization-code/10374/3 "2020-08-04T16:49:58Z")

</div>

Hi @user-823402,

As @andrea mentioned, the problem is with your request URLs.  
But if you’re trying to get the access token to protect your own APIs (as opposed to Okta endpoint APIs), you should use the `api/default/v1` URL.  
Change your call to `oauth2/v1/authorize` in step 2 to `oauth2/default/v1/authorize`

Here `default` refers to the custom authorization server that you as an admin has control over. You can customize it according to your needs wrt scopes, claims, policies, clients that use this server etc.

`oauth2/v1/authorize` on the other hand calls the Okta org authorization server, which you don’t have control over. It’s an inbuilt server used to Okta which mints tokens to protect Okta endpoints.

Hope this helps.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [January 25, 2024, 6:18pm UTC](https://devforum.okta.com/t/creating-token-with-authorization-code/10374/4 "2024-01-25T18:18:07Z")

</div>

Closed on January 25, 2024, 6:18pm UTC