Public
AccessTokens

Create access token (omniauth)

Signs in with an identity the provider vouches for. credentials.token must be the provider's own token (Google ID token, Facebook user access token, Apple identity token); the API checks it with the provider, checks it was issued to Purple Grain, and signs in only the account whose email the provider returned, which must equal info.email and uid. Any other claim, a missing token, or a provider the API cannot verify is a 403. Returns a Doorkeeper access token in JSON (same shape as POST /oauth/token, plus user_id). Use Authorization: Bearer <access_token> on /api/v1/*. Prefer POST /oauth/token when you have a registered OAuth client and want strict RFC 6749 behavior.

post/users/access-tokens

Request

  • Base URL: https://api.purplegrain.com/api/v1
  • URL: https://api.purplegrain.com/api/v1/users/access-tokens
  • Auth: none declared

Request body

providerstring
uidstring

Response

Success — Doorkeeper token response including user_id.

access_tokenstring required

Opaque bearer token. Send as header Authorization: Bearer {token} on /api/v1/* routes.

token_typestring required
expires_ininteger

Lifetime of the access token in seconds.

refresh_tokenstring nullable

Present when the client and grant type allow refresh tokens.

scopestring

Granted scopes (space-separated).

user_idstring uuid nullable

Only returned by first-party JSON endpoints (/users/sign-in, /users/access-tokens), not by POST /oauth/token.

actor_idstring uuid nullable

The acting entity's id (first-party endpoints only). Equals user_id today; becomes the Organization id when a token is scoped to act for an organization.

actor_type'User' | 'Organization' nullable

Polymorphic type of actor_id (first-party endpoints only).

Example response

{
  "token_type": "Bearer"
}

Changes

No recorded changes to this operation across all 3 revisions of this API.