Exchange credentials for JWT

Exchange client credentials or a refresh token for an access token.

Supports three grant types:

Client credentials: provide client_id + client_secret.
Refresh token: provide grant_type=refresh_token + refresh_token.
Authorization code: provide grant_type=authorization_code + code + code_verifier + redirect_uri + client_id.

Request body

grant_type'client_credentials' | 'refresh_token' | 'authorization_code'

Grant type. Use "client_credentials" for service accounts, "refresh_token" to rotate tokens, or "authorization_code" for PKCE auth-code exchange.

client_idstring nullable

OAuth2 client ID. Required for client_credentials and authorization_code grants.

client_secretstring nullable

OAuth2 client secret. Required for client_credentials grant.

refresh_tokenstring nullable

Refresh token issued by a prior token exchange. Required for refresh_token grant.

codestring nullable

Authorization code. Required for authorization_code grant.

code_verifierstring nullable

PKCE code verifier. Required for authorization_code grant.

redirect_uristring nullable

Redirect URI matching the one used at authorization. Required for authorization_code grant.

OK

access_tokenstring required

Short-lived JWT for authenticating API requests. Pass as Bearer token in Authorization header.

refresh_tokenstring nullable

Long-lived token for obtaining new access tokens. Store securely.

expires_ininteger required

Seconds until the access_token expires.

token_typestring

Always "Bearer".