Skip to main content
POST
OAuth2 token endpoint (RFC 6749 §4.1.3 + §6)

Body

application/x-www-form-urlencoded
grant_type
string
required

'authorization_code' or 'refresh_token'.

Minimum string length: 1
code
string

Authorization-code grant only.

Minimum string length: 1
redirect_uri
string

Authorization-code grant only.

Minimum string length: 1
code_verifier
string

Authorization-code grant only (PKCE).

Minimum string length: 1
refresh_token
string

Refresh-token grant only.

Minimum string length: 1
scope
string

Optional refresh-token scope narrowing.

Minimum string length: 1
client_id
string

When not using HTTP Basic.

Minimum string length: 1
client_secret
string

Confidential client only.

Minimum string length: 1

Response

access_token
string
required
token_type
string
required
expires_in
integer
required
refresh_token
string
required
scope
string
required