---
title: "POST /oauth2/token"
method: POST
path: "/oauth2/token"
tags: ["oauth2"]
---

# POST /oauth2/token

`POST /oauth2/token`

Retrieve an oauth2 acces\_token for use with Pricefinder API. A basic auth header is supported as an alternative to the form parameters for username and password.

After retrieving the token, it must be either added as an authorization header(eg Authorization: Bearer <token>) or appended to the query (eg ?access\_token=<token>).

The api supports three 'flows' for retrieving a token; client\_credentials, refresh\_token and authorization\_code

#### client\_credentials

The client credentials flow requires the api user to pass their user name and password to retrieve the token.

#### code\_authorization

The code authorization flow is used to authenticate on behalf of a another user.

To acquire authorization from a third party, direct that user to /v1/auth/authorize.html?client\_id=<username>&state=<random\_number>&redirect\_uri=<callback\_in\_your\_app>. Https is required.

The client\_id is your username.  
The state is a random string used to verify that the authorization request was generated by your webapp.  
The redirect\_uri is the callback uri after the third party has accepted or declined the authorization request.

eg https://api.pricefinder.com.au/v1/auth/authorize.html?client\_id=username&state=123&redirect\_uri=https%3A%2F%2Fyour.web.app%2Fsomepage

The third party will authenticate and authorize access to the api on their behalf. If the user allows access, the third party is redirected to your.web.app/somepage?state=<state>&code=<authorization\_code>

eg https://your.web.app/somepage?state=123&code=9efc4ad1cca0bae6255ffd6db6cc85

(If the user declines, a callback is made with query parameter error=access\_denied)

The api user can then retrieve an access token using this code from /v1/oauth2/token, using the 'authorization\_code' grant type.

eg

curl -X POST --header "Content-Type: application/x-www-form-urlencoded" --header "Accept: application/json" -d "grant\_type=authorization\_code&client\_id=username&client\_secret=password&code=9efc4ad1cca0bae6255ffd6db6cc85&redirect\_uri=https%3A%2F%2Fyour.web.app%2Fsomepage" "https://api.pricefinder.com.au/v1/oauth2/token"

This will return an access token, as well as a refresh token, which can be used to acquire access tokens in the future without requiring the third party to reauthorize.

#### refresh\_token

A refresh token can be used to acquire a new access token without requiring the third party to re authorize the user. This method consumes the refesh token and returns a new access token and a new refresh token.

#### Required Parameters:

*   client\_credentials => client\_id, client\_secret
*   refresh\_token => client\_id, client\_secret, refresh\_token
*   authorization\_code => client\_id, client\_secret, redirect\_uri, code

#### Simple OAuth2 Demonstration / test

[Callback Example](https://api.pricefinder.com.au/v1/oauthTest/initiateOauth.html)

## Response `200`

Token created

- ClientAccessToken
  - `access_token` string
  - `token_type` string
  - `expires_in` string
  - `refresh_token` string

## Other responses

- `400` — Bad Request
- `401` — Invalid username/password

---

[API](https://skmtc.net/pricefinder/apis/pricefinder-api-v1-13-1.md) · [All operations](https://skmtc.net/pricefinder/apis/pricefinder-api-v1-13-1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pricefinder/pricefinder-api-v1-13-1/versions/10efa1470b1d/schema)