Sign in

v1

latestOpenAPI 3.0.32026-08-0670174396.8 KB
OAuth

OAuth token endpoint

Accepts application/x-www-form-urlencoded or application/json.

authorization_code grant: grant_type, code, code_verifier, client_id, redirect_uri

refresh_token grant: grant_type, refresh_token, client_id

post/public/v1/oauth/token/

Request body

grant_type'authorization_code' | 'refresh_token' required

The grant type. Use authorization_code for desktop/CLI apps (requires PKCE), or refresh_token to refresh an expired access token.

codestring

The authorization code received in the redirect. Required for authorization_code grant.

code_verifierstring

PKCE code verifier. The random string used to generate the code_challenge. Required for authorization_code grant.

client_idstring required

The client_id returned during client registration. Required for both grant types.

redirect_uristring

Must match the redirect_uri used in the authorization request. Required for authorization_code grant.

refresh_tokenstring

The refresh token from a previous token response. Required for refresh_token grant.

resourcestring

RFC 8707 resource indicator. If sent, must match the resource from the authorization request.

Response

access_tokenstring required

Bearer token for authenticating API requests.

refresh_tokenstring required

Token used to obtain a new access token when the current one expires.

token_typestring required

Always Bearer.

expires_ininteger required

Lifetime of the access token in seconds.

scopestring required

Space-separated list of scopes granted to this token.