Issue an access token
Exchanges an authorization code, or a refresh token, for a new access token and refresh token. Codes are valid for 10 minutes and refresh tokens work once.
Request Body
application/x-www-form-urlencoded
grant_type*string
Value in
"authorization_code" | "refresh_token"client_id*string
The application's client ID.
client_secret?string
The application's secret. Left out by public applications.
redirect_uri?string
authorization_code only: the same redirect_uri sent to /oauth2/authorize.
code?string
authorization_code only: the code from the redirect.
code_verifier?string
authorization_code only: the PKCE verifier, when a code_challenge was sent.
refresh_token?string
refresh_token only: the refresh token to trade in.
scope?string
refresh_token only: narrow the new token to fewer scopes.
Response Body
application/json
application/json
application/json
curl -X POST "http://localhost:8000/oauth2/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d 'grant_type=authorization_code&client_id=string'{
"token_type": "Bearer",
"expires_in": 0,
"access_token": "string",
"refresh_token": "string"
}{
"error": "string",
"error_description": "string",
"hint": "string",
"message": "string"
}{
"error": "string",
"error_description": "string",
"hint": "string",
"message": "string"
}