RMrmfg
agent-auth

Token

Changed on

Exchange authorization_code + code_verifier, device_code, or refresh_token.

Send application/x-www-form-urlencoded. A refresh token is rotated on every use; serialize refreshes and save the new token. Reuse revokes the connection. Refresh may request the same or fewer approved scopes. A narrower access token does not narrow the connection or its replacement refresh token.

post/v1/oauth/token

Request

  • Base URL
    https://api.rmfg.com
  • URL
    https://api.rmfg.com/v1/oauth/token
  • Auth
    none required

Request body application/x-www-form-urlencoded

client_idstring required
grant_type'authorization_code' | 'refresh_token' | 'urn:ietf:params:oauth:grant-type:device_code' required
codestring

Required for authorization_code.

redirect_uristring

Exact registered callback; required for authorization_code.

code_verifierstring

Required for authorization_code.

device_codestring

Required for device authorization.

refresh_tokenstring

Required for refresh_token. Single use; persist its replacement.

scopestring

Optional for refresh_token: the same or fewer approved permissions. Omit to retain the original grant.

resourcestring

Optional; must equal the API origin.

Response

API-only access and rotating refresh token.

access_tokenstring required
refresh_tokenstring required
token_type'Bearer' required
expires_ininteger required
scopestring required

Granted permissions; may omit requested payments.

Changes