EPeprospera
OAuth 2.0 / OpenID Connect

Exchange an authorization code, device code, or refresh token

Changed on

Use HTTP Basic client authentication when possible. client_secret_post remains supported for compatibility. Public device clients send client_id without a secret. Repeated parameters and multiple client authentication methods are rejected.

Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid.

post/api/oauth/token

Request

Request body application/x-www-form-urlencoded

OR
OR

Response

OAuth tokens.

access_tokenstring required
token_type'Bearer' required
expires_ininteger required
refresh_tokenstring
id_tokenstring
scopestring

Changes

  • d2c5a5cda002Revision changes
    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status