Sign in
OAuth API

Generate tokens

Exchange the authorization code you received from the Authorize endpoint for an 'access token' API credential, with which you can communicate with the Mollie API on behalf of the consenting merchant.

This endpoint can only be accessed using OAuth client credentials.

post/oauth2/tokens

Headers

Authorizationstring required

The OAuth client ID and client secret as basic access credentials.

Pseudo code: "Basic " + toBase64(client_id + ":" + client_secret)

For example: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

Content-Typestring

This header value must match the type of the request body you send, if there is a request body. For example, if you send the request body as JSON, this header must be set to application/json, and if you send it as form encoded you must set this header to application/x-www-form-urlencoded.

idempotency-keystring
Example:123e4567-e89b-12d3-a456-426

A unique key to ensure idempotent requests. This key should be a UUID v4 string.

Request body

grant_type'authorization_code' | 'refresh_token' required
codestring

The authorization code you received when creating the authorization. Only use this field when using grant type authorization_code.

refresh_tokenstring

The refresh token you received when creating the authorization. Only use this field when using grant type refresh_token.

redirect_uristring

The URL the merchant is sent back to once the request has been authorized. It must match the URL you set when registering your app.

For consecutive refresh token requests, this parameter is required only if the initial authorization code grant request also contained a redirect_uri.

Example request

{
  "grant_type": "authorization_code",
  "code": "auth_...",
  "refresh_token": "refresh_...",
  "redirect_uri": "https://example.com/redirect"
}

Response

The newly generated access token and refresh token.

access_tokenstring

The app access token, with which you will be able to access the Mollie API on the merchant's behalf.

refresh_tokenstring

The refresh token, with which you will be able to retrieve new app access tokens on this endpoint. The refresh token does not expire.

expires_ininteger

The number of seconds left before the app access token expires. Be sure to renew your app access token before this reaches zero.

token_typestring

As per OAuth standards, the provided app access token can only be used with bearer authentication.

Possible values: bearer

scopestring

A space-separated list of permissions.

Example response

{
  "access_token": "access_...",
  "refresh_token": "refresh_...",
  "expires_in": 3600,
  "token_type": "bearer",
  "scope": "payments.read"
}

Changes

Changed in 4 of the 79 revisions of this API.66

  • 7cab62b218301See the full diff
    • ○

      added the non-success response with the status

      response-non-success-status-added

  • ffd62224620b2See the full diff
    • ○

      the endpoint scheme security basicAuth was added to the API

      api-security-added

    • ○

      the endpoint scheme security oAuth was removed from the API

      api-security-removed

    This revision also has 1 change that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

  • 98cbf79659c11See the full diff
    • ▲

      media type application/hal+json was changed to a more general media type application/json for the response status

      response-media-type-name-generalized

  • a5774ab4d46553See the full diff
    • ▲

      request property was restricted to a list of enum values

      request-property-became-enum

    • ▲

      the request property became not nullable

      request-property-became-not-nullable

    • ▲

      the request property became not nullable

      request-property-became-not-nullable

    • ▲

      the request property became not nullable

      request-property-became-not-nullable

    • ▲

      removed the media type text/html for the response with the status

      response-media-type-removed

    • ○

      added the new authorization_code enum value to the request property

      request-property-enum-value-added

    • ○

      added the new refresh_token enum value to the request property

      request-property-enum-value-added

    • ○

      added the media type application/hal+json for the response with the status

      response-media-type-added

Of the 79 revisions, 9 have no diff computed.