Client Auth

Exchange grant for access token

Changed on

OAuth 2.0 token endpoint supporting three grant types: authorization_code (standard OAuth flow with Basic auth), urn:ietf:params:oauth:grant-type:device_code (RFC 8628 device authorization for CLI clients), and refresh_token (rotate refresh token and obtain a new access token). The device_code and refresh_token grants authenticate via the privy-app-id header.

post/api/oauth/v2/token

Request

  • Base URL
    https://api.privy.io
  • URL
    https://api.privy.io/api/oauth/v2/token
  • Auth
    none declared

Headers

privy-app-idstring

ID of your Privy app.

Request body

OR
OR

Response

Token issued successfully.

access_tokenstring required

The issued access token.

token_type'Bearer' required

The type of token issued.

expires_innumber

The lifetime in seconds of the access token.

refresh_tokenstring

A refresh token for obtaining new access tokens. Issued for device_code and refresh_token grants.

Changes

  • c10a42ebeddbRevision changes
    • breaking

      the response's property type changed from string to no type for status

    • info

      added subschema #2 to the response property allOf list for the response status

    • info

      removed the access_denied enum value from the response property for the response status

    • info

      removed the authorization_pending enum value from the response property for the response status

    • info

      removed the expired_token enum value from the response property for the response status

    • info

      removed the slow_down enum value from the response property for the response status

  • 4eb0c804ae2bRevision changes
    • info

      endpoint added