Authentication

Exchange a credential for an access token

The OAuth 2.0 token endpoint. grant_type picks the exchange:

client_credentials (RFC 6749 section 4.4): authenticate as a service account, its id as client_id and one of its keys as client_secret, in the form body or as HTTP Basic credentials. The token is a signed JWT that lasts 60 minutes and carries every scope unless scope narrows it. Disabling or revoking the key, or disabling the service account, ends its tokens.
urn:ietf:params:oauth:grant-type:device_code (RFC 8628 section 3.4): a native client polling for the device login it started, with device_code and its client_id. Answers authorization_pending until the person approves, slow_down when polled sooner than the interval, then the token set, once.
refresh_token: a native client renewing the tokens a device login gave it, with refresh_token and its client_id. The refresh token is replaced on every use.

post/oauth/token

Request

Successful Response

access_tokenstring required

A signed JWT access token, sent as Authorization: Bearer <token>. Treat it as opaque.

token_typestring required

Always Bearer.

expires_ininteger required

Seconds until the token expires.

scopestring nullable

The space-delimited scopes the token carries.

refresh_tokenstring nullable

Device and refresh grants only: the refresh token, replaced on every refresh.