auth

Exchange credentials for an access token

Three grants, all application/x-www-form-urlencoded:

  • client_credentials — a workspace credential's id/secret. May also be sent as HTTP Basic.
  • authorization_code — the code from /oauth/authorize, with the PKCE code_verifier. Issues a token that acts as the person who signed in, not a workspace credential — plus a refresh_token, since a person has no secret to silently re-present an hour later.
  • refresh_token — trades the refresh token from an authorization_code grant for a new access/refresh pair. Rotated: the old refresh token stops working the moment this succeeds. Pass org_id to move to a DIFFERENT workspace the same person belongs to, without a second trip through the browser — checked fresh against live membership, same as a new sign-in would be.

Either way the token is a bearer token for this API and nothing else — it is not a planner session and cannot be used against the app.

post/v1/oauth/token

Request

  • Base URL: https://api.flowral.app
  • URL: https://api.flowral.app/v1/oauth/token
  • Auth: none required

Response

SUCCESS

access_tokenstring required
token_typestring required
expires_ininteger required

Seconds.

scopestring

Space-separated, and never more than the credential was granted.

Example response

{
  "token_type": "Bearer",
  "expires_in": 3600
}

Changes

No recorded changes to this operation across all 1 revision of this API.