OAuth

OAuth2 token endpoint

Changed on

Exchanges a single-use authorization code for an Aura Historia access token (RFC 6749 §4.1.3). The request body must be application/x-www-form-urlencoded. Client authentication is performed via client_id / client_secret form fields. PKCE code verification (RFC 7636) is mandatory: code_verifier must produce the code_challenge supplied to the authorize endpoint.

The issued access token is non-expiring by default (same lifetime as tokens created via POST /api/v1/me/access-tokens). Successful responses also include a short-lived third_party_exchange_code that can be redeemed once via GET /api/v1/oauth/tokens/by-third-party-code/{thirdPartyCode}. The exchange code expires after 60 seconds and is deleted on first use.

post/api/v1/oauth/token

Request

  • Base URL: https://api.stage.aura-historia.com
  • URL: https://api.stage.aura-historia.com/api/v1/oauth/token
  • Auth: none declared

Response

Access token issued successfully.

access_tokenstring required

The issued Aura Historia access token (plaintext bearer value).

token_type'BEARER' required

Token type returned for Aura Historia access tokens.

expires_ininteger nullable

Seconds until the access token expires. null when the token does not expire.

scopestring required

Space-separated list of scopes granted to the access token.

third_party_exchange_codestring uuid

Optional one-time exchange code returned by POST /api/v1/oauth/token. It can be redeemed once via GET /api/v1/oauth/tokens/by-third-party-code/{thirdPartyCode} within 60 seconds to obtain the same access token.

Example response

{
  "access_token": "aurahistoria_abcdefghijk_verylongtokenvalue",
  "token_type": "BEARER",
  "scope": "product-listings:write",
  "third_party_exchange_code": "01970f22-2bf0-7000-8000-000000000099"
}

Changes

  • 999eda3fdd63Revision changes
    • breaking

      removed the required property / from the response with the status

    • breaking

      removed the required property / from the response with the status

    • breaking

      removed the required property / from the response with the status

    • info

      the request property format was generalized from uuid to no format

    • info

      added the required property / to the response with the status

    • info

      added the required property / to the response with the status

    • info

      added the required property / to the response with the status