OAuth2 token endpoint
Exchanges an authorization code for access and refresh tokens, or refreshes an expired access token. Supports `authorization_code` and `refresh_token` grant types, as well as `client_credentials` for server-to-server. Accepts both `application/json` and `application/x-www-form-urlencoded` bodies.
Exchanges an authorization code for access and refresh tokens, or refreshes
an expired access token. Supports authorization_code and refresh_token
grant types, as well as client_credentials for server-to-server.
Accepts both application/json and application/x-www-form-urlencoded bodies.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
curl -X POST "https://example.com/api/v1/oauth/token" \ -H "Content-Type: application/json" \ -d '{ "grant_type": "authorization_code", "client_id": "string" }'{ "access_token": "string", "token_type": "Bearer", "expires_in": 0, "refresh_token": "string", "scope": "string"}{ "error": "invalid_request", "error_description": "string"}OAuth2 authorization endpoint GET
Validates an OAuth2 authorization request and redirects to the consent screen. Supports the Authorization Code flow with PKCE. Required query parameters: - `response_type` — must be `code` - `client_id` — OAuth2 app client ID - `redirect_uri` — must match a registered redirect URI - `scope` — space-separated list of requested scopes - `code_challenge` — PKCE code challenge - `code_challenge_method` — `S256` - `state` — opaque state string echoed back on redirect
OAuth2 token revocation (RFC 7009) POST
Revokes an access or refresh token. Accepts JSON or form-urlencoded.