COcoder
Enterprise

OAuth2 token exchange.

Changed on
post/oauth2/tokens

Request

  • Base URL
    / (relative, and the document was published on a file host, not at the API’s origin)
  • URL
    /oauth2/tokens
  • Auth
    none declared

Request body application/x-www-form-urlencoded

client_idstring

Client ID, required if grant_type=authorization_code

client_secretstring

Client secret, required if grant_type=authorization_code and the client is confidential. Public clients (token_endpoint_auth_method=none) send no secret.

codestring

Authorization code, required if grant_type=authorization_code

code_verifierstring

PKCE code verifier, required if grant_type=authorization_code. 43-128 characters per RFC 7636.

refresh_tokenstring

Refresh token, required if grant_type=refresh_token

grant_type'authorization_code' | 'refresh_token' | 'password' | 'client_credentials' | 'implicit' required

Grant type

Response

OK

access_tokenstring
expires_ininteger
expirystring date-time

Expiry is not part of RFC 6749 but is included for compatibility with golang.org/x/oauth2.Token and clients that expect a timestamp.

refresh_tokenstring
scopestring
token_type'Bearer' | 'DPoP'

Changes