OAuth

OAuth 2.1 token endpoint

Exchanges an authorization code (with PKCE verifier) or a refresh token for a new access token (and rotated refresh token). Body MUST be application/x-www-form-urlencoded per RFC 6749. Response carries Cache-Control: no-store. Confidential clients authenticate by passing client_secret in the body; public clients omit it. Refresh token reuse triggers family-wide revocation of all access + refresh tokens issued from the original grant.

post/oauth/token

Request

  • Base URL: https://app.buildworkpro.com/api/v1
  • URL: https://app.buildworkpro.com/api/v1/oauth/token
  • Auth: none required

Response

Access token issued

access_tokenstring required
token_type'Bearer' required
expires_ininteger required
refresh_tokenstring
scopestring required

Changes

No recorded changes to this operation across all 1 revision of this API.