Skip to main content
POST
Issues a new Access Token and Refresh Token using an Authorization Code (authorization_code), or refreshes an expired Access Token using a Refresh Token (refresh_token).

Header parameters

Content-Type
string
required
Must be application/x-www-form-urlencoded.
Authorization
string
required
Client credentials encoded in Base64: Basic base64({CLIENT_ID}:{CLIENT_SECRET}).

Body parameters

grant_type
string
required
Token grant type. Must be authorization_code or refresh_token.
code
string
Required when grant_type=authorization_code. The Authorization Code received from /oauth/authorize.
redirect_uri
string
Required when grant_type=authorization_code. Must exactly match the URI used in the Authorization Code request.
refresh_token
string
Required when grant_type=refresh_token. The Refresh Token to use for renewal.
code_verifier
string
PKCE code verifier. Required if a code_challenge was provided in the Authorization Code request.

Response

access_token
string
Access Token. Used as a Bearer token in API calls.
token_type
string
Token type. Always Bearer.
expires_in
integer
Access Token validity period in seconds (600 seconds = 10 minutes).
refresh_token
string
Refresh Token. Used to renew the Access Token. Valid for 3 hours.
scope
string
Space-separated list of granted permission scopes.