Exchange an authorization code, device code, or refresh token

Use HTTP Basic client authentication when possible. client_secret_post remains supported for compatibility. Public device clients send client_id without a secret. Repeated parameters and multiple client authentication methods are rejected.

post/api/oauth/token

Response

OAuth tokens.

access_tokenstring required

token_type'Bearer' required

expires_ininteger required

refresh_tokenstring

id_tokenstring

scopestring

Changes

No recorded changes to this endpoint across all 1 revision of this API.