OAuth2 Token Endpoint
const url = 'https://api.example.com/oauth2/access_token';const options = { method: 'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded'}, body: new URLSearchParams({ grant_type: 'authorization_code', client_id: 'example', client_secret: 'example', code: 'example', redirect_uri: 'https://example.com', code_verifier: 'example', refresh_token: 'example', username: 'example', password: 'example' })};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.example.com/oauth2/access_token \ --header 'Content-Type: application/x-www-form-urlencoded' \ --data grant_type=authorization_code \ --data client_id=example \ --data client_secret=example \ --data code=example \ --data redirect_uri=https://example.com \ --data code_verifier=example \ --data refresh_token=example \ --data username=example \ --data password=exampleExchanges authorization codes or refresh tokens for access tokens.
Request Bodyrequired
Section titled “Request Bodyrequired”object
Grant type, must be authorization_code or refresh_token or password or otp or activation
The client application’s identifier.
The client application’s secret.
Authorization code received from the /oauth2/authorize endpoint, the OTP code, or the account activation code.
The same redirect URI used in the authorization request.
Original code verifier used in PKCE flow.
Refresh token for obtaining new access tokens.
Customer e-mail, or for third-party authentication, use the values facebook, google, or apple. See documentation.
Plain-text password or JSON-encoded string of token, source, and name. See documentation.
object
Grant type, must be authorization_code or refresh_token or password or otp or activation
The client application’s identifier.
The client application’s secret.
Authorization code received from the /oauth2/authorize endpoint, the OTP code, or the account activation code.
The same redirect URI used in the authorization request.
Original code verifier used in PKCE flow.
Refresh token for obtaining new access tokens.
Customer e-mail, or for third-party authentication, use the values facebook, google, or apple. See documentation.
Plain-text password or JSON-encoded string of token, source, and name. See documentation.
object
Grant type, must be authorization_code or refresh_token or password or otp or activation
The client application’s identifier.
The client application’s secret.
Authorization code received from the /oauth2/authorize endpoint, the OTP code, or the account activation code.
The same redirect URI used in the authorization request.
Original code verifier used in PKCE flow.
Refresh token for obtaining new access tokens.
Customer e-mail, or for third-party authentication, use the values facebook, google, or apple. See documentation.
Plain-text password or JSON-encoded string of token, source, and name. See documentation.
object
Grant type, must be authorization_code or refresh_token or password or otp or activation
The client application’s identifier.
The client application’s secret.
Authorization code received from the /oauth2/authorize endpoint, the OTP code, or the account activation code.
The same redirect URI used in the authorization request.
Original code verifier used in PKCE flow.
Refresh token for obtaining new access tokens.
Customer e-mail, or for third-party authentication, use the values facebook, google, or apple. See documentation.
Plain-text password or JSON-encoded string of token, source, and name. See documentation.
Responses
Section titled “Responses”Successful token response.
object
The access token issued by the authorization server.
The type of the token issued (typically ‘Bearer’).
Lifetime in seconds of the access token.
Refresh token to obtain new access tokens.
Scopes granted to the access token.
Example generated
{ "access_token": "example", "token_type": "example", "expires_in": 1, "refresh_token": "example", "scope": "example"}Invalid request or authorization code.
Invalid client credentials or unauthorized request.