Create a new OAuth2 access token

Please be aware that the required parameters are contingent on the grant_type that you select.

For the authorization_code grant type, you are required to pass in the code and redirect_uri parameters. service, username and password parameters will be ignored.

For the client_credentials grant type, you do not need to pass in any additional parameters beyond the basic requirements. code, redirect_uri, service, username and password parameters will be ignored.

For the device_code grant type, you are required to pass in the code parameter. If you are a third-party developer, you are also required to provide the scope parameter; see the documentation for GET /v2/authorize for possible values. redirect_uri, service, username and password parameters will be ignored.

For the password grant type, you are required to pass in the username and password parameters. The code and redirect_uri parameters are ignored. Third-party developers do not have access to this grant type.

For the refresh_token grant type, you are required to pass in the refresh_token parameter. The scope parameter can optionally be used to request a different set of scopes than were used in the original request, but it cannot contain any scopes that were not previously requested. If not specified, then scope will be set to whichever scopes were used for the original access token request. If trading in an old non-expiring access token for a refresh-enabled token, set the value of refresh_token to the access token value and token_type_hint must be set to access_token. code, redirect_uri, service, username and password parameters will be ignored.

The anonymous_user grant type is a custom grant type created by NPR to suit our needs for functionality such as our "try-before-you-buy" experience. If you are a third-party developer, you will not have access to this grant type unless we have explicitly given you permission within our system. For this grant type, if you are a third-party developer, you are required to provide the scope parameter; see the documentation for GET /v2/authorize for possible values. code, redirect_uri, service, username and password parameters will be ignored.

The third_party grant type is another custom grant type created by NPR to handle login via third-party providers such as Facebook and Google. If you are a third-party developer, you will not have access to this grant types unless we have explicitly given you permission within our system. For this grant type, you are required to pass in the service and token parameters. If you are a third-party developer, you are also required to provide the scope parameter; see the documentation for GET /v2/authorize for possible values. The code and redirect_uri parameters are ignored.

If you are unsure of which grant type to select, assume that authorization_code is the one you want.

Note that at this time, refresh tokens are an opt-in feature; however, in the future, they will gradually transition to being opt-out, and ultimately required for all clients. Our general guidance at this time is that if this endpoint starts returning refresh tokens for you, you are responsible for implementing the code to handle them appropriately in accordance with the OAuth 2.0 spec. For more information about our gradual rollout of this feature, please contact the NPR One API team.