TItight
OAuth

Request access token

Exchange client credentials (and optionally a userId) for an access token.

Supports authorization_code, client_credentials, and refresh_token grant types. Authenticate using HTTP Basic auth

post/v6/auth/token

Request

Request body application/x-www-form-urlencoded

grant_type'client_credentials' | 'authorization_code' | 'refresh_token'

The OAuth 2.0 grant type to use. Defaults to client_credentials

userIdstring

The Tight user ID to generate a scoped token for. Omit to generate a partner-level token with access to all companies.

apiCompanyIdstring

Scopes a bookkeeper's token to a single company. Provide the userId of a bookkeeper together with the apiCompanyId of a company they can access to generate a token that acts as that bookkeeper working on behalf of that specific company. Requires userId to be the ID of a bookkeeper.

codestring

The authorization code received from the authorization endpoint. Required for authorization_code grant type.

redirect_uristring

The redirect URI used in the authorization request. Required for authorization_code grant type.

code_verifierstring

The PKCE code verifier. Required when code_challenge_method=S256 was used in the authorization request.

refresh_tokenstring

The refresh token to exchange for a new access token. Required for refresh_token grant type.

scope'read' | 'write'

Limits the token's permissions. Use read to create a read-only token, or write to allow write access. Defaults to write if omitted.

Response

Access token issued successfully

access_tokenstring

The bearer token to include in API requests.

token_type'Bearer'
expires_ininteger

Token lifetime in seconds.

refresh_tokenstring

Refresh token, returned for authorization_code grant types.

scopestring

Space-separated list of granted scopes, if applicable.

Example response

{
  "access_token": "eyJhbGciOiJSUzI1NiJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "tGzv3JOkF0XG5Qx2TlKWIA"
}

Changes

No recorded changes to this operation across all 1 revision of this API.