OAuth

Token endpoint (exchange code or refresh token).

RFC 6749 §3.2. Form-encoded. grant_type=authorization_code exchanges a PKCE-bound code (send code_verifier) for a 15-min access token (+ refresh token when offline_access was granted). grant_type=refresh_token rotates the refresh token. Confidential clients also send client_secret. Responses are Cache-Control: no-store.

post/api/oauth/token

Request

  • Base URL: https://app.tracepass.eu
  • URL: https://app.tracepass.eu/api/oauth/token
  • Auth: none required

Response

Access token issued.

access_tokenstring
token_type'Bearer'
expires_ininteger
scopestring
refresh_tokenstring

Present only when offline_access was granted.

Example response

{
  "expires_in": 900
}

Changes

No recorded changes to this operation across all 1 revision of this API.