v1

latestOpenAPI 3.0.32026-08-061874701.5 MB

tokens

Gets or refreshes an access token

Gets or refreshes an access token, as part of the OAuth process.

post/token

Query parameters

client_idstring required

The client ID you obtained when you registered your app.

client_secretstring

(Optional) Must use either this value or hash. Plain text method for sending this value. For example, client_secret={app_secret}. Encryption occurs at the HTTPS level.

codestring

Authorization code acquired after user selects "Allow" in the Web login UI.

grant_type'authorization_code' | 'refresh_token' required

Must be set to "authorization_code".

hashstring

(Optional) Must use either this value or client_secret. SHA-256 hash of your app secret concatenated with a pipe and the authorization code. For example, hash={SHA_256(app_secret|code)}.

refresh_tokenstring

refresh_token value that came with the access token.

redirect_urlstring

Deprecated If supplied, must match the redirect URI you registered for your app.

Headers

Content-Type'application/x-www-form-urlencoded'

Required for POST and PUT requests. Defines the structure for the response.

Response

An access token

access_tokenstring

A credential that can be used by a client to access the Smartsheet API.

token_typestring

How an access token will be generated and presented. Smartsheet uses the bearer parameter, which means essentially give access to the bearer of this token.

expires_innumber

Number of seconds token is valid once issued.

refresh_tokenstring

A credential tied to the access token that can be used to obtain a fresh access token with the same permissions, without further involvement from a user.