Sign in

v10

latestOpenAPI 3.0.0raw.githubusercontent.com2026-07-0582185581.9 KB
OAuth Provider

Exchange authorization code for tokens

OAuth 2.0 Token Endpoint (RFC 6749 Section 4.1.3).

Exchanges an authorization code, client credentials, or refresh token for access tokens.

Grant Types:

  • authorization_code: Exchange auth code for tokens (user-based)
  • client_credentials: Get tokens for machine-to-machine auth
  • refresh_token: Get new access token using refresh token

For client_credentials, access tokens represent the OAuth app creator (the user who registered the client). The JWT may encode userId === client_id; the Node API gateway resolves the creator (createdBy claim or OAuth app lookup) — see OAuth Provider tag.

Client Authentication: Can be provided via:

  • HTTP Basic auth: Authorization: Basic base64(client_id:client_secret)
  • Request body: client_id and client_secret parameters

PKCE Verification: If authorization used PKCE, the code_verifier must be provided and will be verified against the stored code challenge.

post/oauth2/token

Request body

grant_type'authorization_code' | 'client_credentials' | 'refresh_token' required

OAuth grant type:

  • authorization_code: Exchange auth code for tokens
  • client_credentials: Machine-to-machine auth
  • refresh_token: Get new access token using refresh token
codestring

Authorization code (required for authorization_code grant)

redirect_uristring uri

Redirect URI (required for authorization_code grant)

client_idstring

Client ID (can also be sent via Basic auth header)

client_secretstring

Client secret (can also be sent via Basic auth header)

refresh_tokenstring

Refresh token (required for refresh_token grant)

scopestring

Requested scopes (optional, defaults to original grant scopes)

code_verifierstring

PKCE code verifier (RFC 7636). Required if code_challenge was used. Must be 43-128 characters from [A-Za-z0-9-._~]

Response

Tokens issued successfully

access_tokenstring

The access token for API requests

token_typestring

Token type (always "Bearer")

expires_ininteger

Access token lifetime in seconds

refresh_tokenstring

Refresh token for obtaining new access tokens

scopestring

Granted scopes (may differ from requested)

id_tokenstring

OpenID Connect ID token (JWT) if openid scope was requested

Example response

{
  "token_type": "Bearer",
  "expires_in": 3600
}
All 82 operations