DEdepop
Authentication

OAuth 2.0 token endpoint (authorization code exchange and refresh token)

Token endpoint supporting multiple grant types according to RFC 6749: - Authorization Code (Section 4.1.3): Exchange authorization code for access tokens - Refresh Token (Section 6): Exchange refresh token for new access tokens Authorization Code Flow: Requires PKCE (Proof Key for Code Exchange) with S256 challenge method according to RFC 7636. The code_verifier parameter is required and must match the code_challenge from the authorization request. The scopes granted during authorization are retrieved and included in the generated access token. Refresh Token Flow: Exchange a partner refresh token for a new access token and refresh token pair. The original refresh token is consumed and cannot be reused. The new refresh token maintains the same expiry as the original (1 year from initial creation).

post/api/v1/oauth2/access-token/

Request

Request body application/x-www-form-urlencoded

grant_type'authorization_code' | 'refresh_token' required

OAuth 2.0 grant type - 'authorization_code' to exchange code for tokens, 'refresh_token' to refresh access token

codestring

Authorization code received from the authorization endpoint (required for authorization_code grant)

redirect_uristring uri

Redirect URI that must match the one used in authorization request (required for authorization_code grant)

client_idstring required

OAuth client identifier

client_secretstring required

OAuth client secret for authentication

code_verifierstring

PKCE code verifier used to verify the code_challenge from the authorization request. Required for all authorization code flows (PKCE is mandatory). Must be 43-128 characters long and contain only [A-Za-z0-9._~-] characters. Not used for refresh_token grant.

refresh_tokenstring

Partner refresh token to exchange for new tokens (required for refresh_token grant)

Example request

{
  "grant_type": "authorization_code",
  "code": "placeholder_auth_code_12345",
  "redirect_uri": "https://example.com/auth/callback",
  "client_id": "a1b2c3d4e5f6g7h8i9j0",
  "client_secret": "client_secret_abc123",
  "code_verifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
  "refresh_token": "prt_26f4f74b761c83ef0d383bcfc419e114fd554331"
}

Response

Successfully exchanged authorization code or refresh token for access and refresh tokens

access_tokenstring required

Partner access token with 1 hour expiry

refresh_tokenstring required

Partner refresh token with 1 year expiry

expires_ininteger required

Access token expiry time in seconds (3600 = 1 hour)

token_type'Bearer'

Example response

{
  "access_token": "pat_4eea1fdb98106005fea67ed65138df69afa0e6aa",
  "refresh_token": "prt_26f4f74b761c83ef0d383bcfc419e114fd554331",
  "expires_in": 3600,
  "token_type": "Bearer"
}

Changes

No recorded changes to this operation across all 1 revision of this API.