OWownerrez
OAuth

Exchange a code or refresh token for an access token (alias).

Changed on

Identical to POST /oauth/token; both routes run the same handler. New integrations should use /oauth/token.

Authenticates the OAuth app itself, not a user: HTTP Basic with your client id as the username and client secret as the password. An account email and Personal Access Token do not work here.

post/oauth/access_token

Request

  • Base URL
    https://api.ownerrez.com
  • URL
    https://api.ownerrez.com/oauth/access_token
  • Auth
    HTTP basic

Request body application/x-www-form-urlencoded

grant_typestring

One of authorization_code, refresh_token, token_upgrade, or urn:ietf:params:oauth:grant-type:device_code.

codestring

The authorization code, for grant_type=authorization_code.

redirect_uristring

The same redirect_uri used to obtain the code.

code_verifierstring

The PKCE verifier, when the authorize request sent a code_challenge.

refresh_tokenstring

The refresh token (rt_…), for grant_type=refresh_token.

access_tokenstring

The existing token to convert, for grant_type=token_upgrade.

device_codestring

The device code, for the device-code grant.

Response

The issued token.

access_tokenstring

The access token (at_…). Send it as Authorization: Bearer {token}.

token_typestring

Always bearer.

scopestring

The granted scope: read or full.

user_idinteger

The OwnerRez account this token acts on.

user_display_namestring

Display name of that account.

refresh_token_supportedboolean

Whether this app's policy issues refresh tokens.

refresh_tokenstring

The refresh token (rt_…); present when the app's policy supports refresh.

expires_ininteger

Seconds until the access token expires; absent when the token does not expire.

expires_atstring

Expiry timestamp; absent when the token does not expire.

Changes