Get Access Token

Obtain access token for accessing API resources.

Supports three grant types:

• client_credentials: two modes share this grant type:

  • Provide an existing refresh token as a Bearer Authorization header to exchange it for an access token (use user_id to access a foreign account that granted you access). To obtain a refresh token, log in at https://www.sklik.cz/.
  • Or authenticate as an OAuth2 client (RFC 6749 §4.4) with client_id/client_secret supplied either via HTTP Basic auth or the client_id/client_secret form fields, to obtain a client-only access token (no refresh token). A client that is allowed to access any account may pass user_id to obtain a token acting on that account instead; the token's scope still comes only from the client's own roles.

• authorization_code (RFC 6749 §4.1.3, RFC 7636): exchange a single-use authorization code for an access + refresh token pair. Requires code and redirect_uri. code_verifier is required when PKCE was used during authorization.

• refresh_token (RFC 6749 §6): obtain a new access token from a previously issued refresh token passed as the refresh_token form field.

Pass scope to obtain a token narrower than the refresh token you are exchanging.

Use the access token in the Authorization header as a Bearer token. For example: Authorization: Bearer {access_token}.