oauth

Token endpoint

Exchanges an authorization code (with PKCE code_verifier) or a refresh token for tokens. Accepts application/x-www-form-urlencoded or application/json. Client authentication: none (public clients), client_secret_basic, or client_secret_post. A Client ID Metadata Document client is public: it sends its document URL as client_id, with no secret. Authorization codes are single-use and live 5 minutes; a code presented twice revokes everything it minted (RFC 9700). Access tokens live 1 hour, refresh tokens rotate and live 30 days. Every OAuth grant ends 90 days after the user approved it, however often its refresh token rotates; refresh then answers invalid_grant and the user approves again. Refresh also answers invalid_grant when the client has been disabled or the user's Microsoft Entra account is disabled or deleted.

post/api/oauth/token

Request

  • Base URL: https://app.presify.io
  • URL: https://app.presify.io/api/oauth/token
  • Auth: none declared

Request body

grant_type'authorization_code' | 'refresh_token' required
codestring

authorization_code grant.

redirect_uristring uri

authorization_code grant; must equal the authorize redirect_uri.

code_verifierstring

authorization_code grant (PKCE).

refresh_tokenstring

refresh_token grant.

client_secretstring

Confidential clients (client_secret_post).

scopestring
resourcestring uri

Response

Token response (RFC 6749 §5.1).

access_tokenstring required
token_type'Bearer' required
expires_ininteger required

Seconds (3600).

refresh_tokenstring

Rotating; the previous refresh token is invalidated.

scopestring required

Changes

No recorded changes to this operation across all 1 revision of this API.