---
title: "OAuth2 Token"
method: POST
path: "/oauth2/token"
tags: ["Authentication"]
---

# OAuth2 Token

`POST /oauth2/token`

## Request

- Base URL: `https://platform.hootsuite.com`
- URL: `https://platform.hootsuite.com/oauth2/token`
- Auth: HTTP basic

[OAuth2 Token](https://tools.ietf.org/html/rfc6749#section-3.2) endpoint. The required parameters depend on the grant type requested:

|Required Parameter|Grant Type|
|---|---|
|code|authorization_code|
|redirect_uri|authorization_code|
|member_id|member_app|
|organization_id|organization_app|
|refresh_token|refresh_token|

This endpoint requires that you pass in your client credentials using the HTTP Basic authentication scheme as per outlined in the [spec](https://tools.ietf.org/html/rfc6749#section-2.3.1).
Including your client credentials in the request-body is not supported.

**Note**: The specific authorization code provided for the `code` parameter must only be used successfully once. If an authorization code is used a second time, all tokens granted with the first `/oauth2/token` call will be revoked.

## Headers

- `Authorization` string, required

## Request body `application/x-www-form-urlencoded`

- object
  - `grant_type` 'authorization_code' | 'client_credentials' | 'member_app' | 'organization_app' | 'refresh_token', required: The OAuth2 grant_type used.
  - `code` string: The authorization code granted by the /oauth2/auth endpoint. Required for grant type: authorization_code
  - `redirect_uri` string: The URI to redirect to after authentication. Required for grant type: authorization_code
  - `member_id` string: The member id of the user to grant a token for. Required for grant type: member_app
  - `organization_id` string: The organization id to grant a token for. Required for grant type: organization_app
  - `refresh_token` string: The refresh token code previously granted. Required for grant type: refresh_token

## Response `200`

Success

- OAuth2BearerToken
  - `access_token` string: The access token.
  - `token_Type` string: The access token type.
  - `expires_in` number: The number of seconds until expiry
  - `refresh_token` string: The refresh token.
  - `scope` string: The scopes granted to this token.

## Other responses

- `400`: Bad Request
- `401`: Unauthorized

---

[API](https://skmtc.dev/hootsuite/apis/hootsuite-rest-api.md) - [All operations](https://skmtc.dev/hootsuite/apis/hootsuite-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/hootsuite/apis/hootsuite-rest-api/revisions/adac53bd28bb?raw)