v1

latestOpenAPI 3.1.02026-08-043160244.3 KB

OAuth

Get OAuth Access Token

Exchange OAuth credentials for a bearer access token. This single endpoint serves all three supported grant types, selected by the grant_type form field. The client authenticates with HTTP Basic auth (client_id:client_secret, base64-encoded) in the Authorization header.

grant_type	Flow	Required fields (besides grant_type and client_id)
client_credentials	Client Credentials	client_secret
authorization_code	Code Authorisation	code, plus redirect_uri if multiple are registered
refresh_token	Code Authorisation	refresh_token

The authorization_code and refresh_token grants belong to the Code Authorisation flow, whose consent redirect happens in the browser before this exchange. See the Code Authorisation guide for the full flow and redirect URI rules.

post/oauth/token

Response

OAuth access token

access_tokenstring required

access token - can then be used directly to access protected endpoints

expires_ininteger required

token expiry in seconds

refresh_tokenstring nullable

token_typestring required

token type, currently always bearer

Example response

{
  "access_token": "19fececa27edf4638a1c0024ee2ea7136",
  "expires_in": 3600,
  "token_type": "bearer"
}