diff --git a/paskia/fastapi/oid.py b/paskia/fastapi/oid.py
index f4b4754..8737900 100644
--- a/paskia/fastapi/oid.py
+++ b/paskia/fastapi/oid.py
@@ -99,7 +99,7 @@ def _parse_client_credentials(
 @app.post("/token")
 async def token(
     request: Request,
-    grant_type: str = Body(..., embed=False),
+    grant_type: str | None = Body(None, embed=False),
     code: str | None = Body(None, embed=False),
     redirect_uri: str | None = Body(None, embed=False),
     client_id: str | None = Body(None, embed=False),
@@ -127,6 +127,13 @@ async def token(
         code_verifier = form.get("code_verifier", code_verifier)
         refresh_token = form.get("refresh_token", refresh_token)
 
+    # Validate grant_type is present
+    if not grant_type:
+        return JSONResponse(
+            {"error": "invalid_request", "error_description": "Missing grant_type"},
+            status_code=400,
+        )
+
     # Get client credentials (required for all grant types)
     client_id, client_secret = _parse_client_credentials(
         request, client_id, client_secret