OAuth

Exchange an authorization code, or refresh, for a bearer token

grant_type: authorization_code (with code_verifier, PKCE S256) or refresh_token. A public client's PKCE verifier or refresh token IS its credential. A confidential client authenticates on both grants by the method it registered (HTTP Basic, or client_secret in the body) and may omit PKCE unless it sent a code_challenge at authorize. Replaying a used code or refresh token revokes the whole token family.

post/api/oauth2/token

Request

  • Base URL: https://saltapp.ai
  • URL: https://saltapp.ai/api/oauth2/token
  • Auth: none required

Request body

grant_type'authorization_code' | 'refresh_token' required
codestring
client_idstring
client_secretstring

Confidential client registered as client_secret_post only.

redirect_uristring
code_verifierstring
resourcestring
refresh_tokenstring

Response

OK.

access_tokenstring

sat_-prefixed.

token_type'Bearer'
expires_ininteger
refresh_tokenstring

srt_-prefixed.

scopestring
resourcestring

Changes

No recorded changes to this operation across all 3 revisions of this API.