OWownerrez
OAuth

Exchange a code or refresh token for an access token.

Changed on

Send application/x-www-form-urlencoded. grant_type is one of authorization_code (with code, redirect_uri and, for PKCE, code_verifier), refresh_token (with refresh_token), token_upgrade (with access_token), or urn:ietf:params:oauth:grant-type:device_code (with device_code).

Authenticates the OAuth app itself, not a user: HTTP Basic with your client id as the username and client secret as the password. An account email and Personal Access Token do not work here.

Issuing a token revokes any token this app already held for the same user, and a refresh rotates both the access and refresh tokens. Get an authorization code by sending the user to https://app.ownerrez.com/oauth/authorize. See OAuth apps.

post/oauth/token

Request

  • Base URL
    https://api.ownerrez.com
  • URL
    https://api.ownerrez.com/oauth/token
  • Auth
    HTTP basic

Request body application/x-www-form-urlencoded

grant_typestring

One of authorization_code, refresh_token, token_upgrade, or urn:ietf:params:oauth:grant-type:device_code.

codestring

The authorization code, for grant_type=authorization_code.

redirect_uristring

The same redirect_uri used to obtain the code.

code_verifierstring

The PKCE verifier, when the authorize request sent a code_challenge.

refresh_tokenstring

The refresh token (rt_…), for grant_type=refresh_token.

access_tokenstring

The existing token to convert, for grant_type=token_upgrade.

device_codestring

The device code, for the device-code grant.

Response

The issued token.

access_tokenstring

The access token (at_…). Send it as Authorization: Bearer {token}.

token_typestring

Always bearer.

scopestring

The granted scope: read or full.

user_idinteger

The OwnerRez account this token acts on.

user_display_namestring

Display name of that account.

refresh_token_supportedboolean

Whether this app's policy issues refresh tokens.

refresh_tokenstring

The refresh token (rt_…); present when the app's policy supports refresh.

expires_ininteger

Seconds until the access token expires; absent when the token does not expire.

expires_atstring

Expiry timestamp; absent when the token does not expire.

Changes