POST/oauth/token
Request body
- grant_typeobjectrequired
authorization_code refresh_token- codestring
- redirect_uristring (uri)
- code_verifierstring
- refresh_tokenstring
Response
- access_tokenstringrequired
- Valid for 900 seconds.
- refresh_tokenstringrequired
- Valid for 30 days, and replaced on every refresh.
- token_typeobjectrequired
- expires_inobjectrequired
- scopestringrequired
- Granted scopes, space-separated.
- store_idstring (uuid)required
- installation_idstring (uuid)required
- installation_generationinteger
- grant_revisioninteger
- operation_idstring (uuid)
Errors
| HTTP | Code | Meaning |
|---|
| 401 | INVALID_CLIENT | Client authentication failed. |
| 400 | PKCE_MISMATCH | code_verifier does not match. |
| 400 | INVALID_CODE | The authorization code expired or is invalid. |
| 400 | REFRESH_ALREADY_USED | The refresh token was already used. |
| 400 | TOKEN_REUSE_DETECTED | Resent after success; tokens were revoked. |
| 409 | RESULT_UNAVAILABLE_REAUTHORIZE | The result was lost; recover, then authorize again. |
Shared codes are listed in Errors.
