diff --git a/src/Obsidian/Controllers/OAuth/OAuth20Controller.cs b/src/Obsidian/Controllers/OAuth/OAuth20Controller.cs
index dcb91b2..0f02fe0 100644
--- a/src/Obsidian/Controllers/OAuth/OAuth20Controller.cs
+++ b/src/Obsidian/Controllers/OAuth/OAuth20Controller.cs
@@ -166,6 +166,7 @@ public async Task<IActionResult> SignOut([FromForm]OAuthSignOutModel model)
 
         [HttpPost("oauth20/token")]
         [ValidateModel]
+        [AllowAnonymous]
         public async Task<IActionResult> Token([FromBody]AuthorizationCodeGrantRequestModel model)
         {
             if ("authorization_code".Equals(model.GrantType, StringComparison.OrdinalIgnoreCase))