OAuth

Get OAuth Access Token

Exchange OAuth credentials for a bearer access token. This single endpoint serves all three supported grant types, selected by the grant_type form field. The client authenticates with HTTP Basic auth (client_id:client_secret, base64-encoded) in the Authorization header.

grant_type	Flow	Required fields (besides grant_type and client_id)
client_credentials	Client Credentials	client_secret
authorization_code	Code Authorisation	code, plus redirect_uri if multiple are registered
refresh_token	Code Authorisation	refresh_token

The authorization_code and refresh_token grants belong to the Code Authorisation flow, whose consent redirect happens in the browser before this exchange. See the Code Authorisation guide for the full flow and redirect URI rules.

post/oauth/token

Request

Base URL
https://api.treasuryspring.com
Auth
HTTP basic

Request body application/x-www-form-urlencoded

client_idstring required

The client id.

client_secretstring required

The client secret for client credentials flow.

grant_typestring required

The type of grant being requested.

redirect_uristring

The redirect URI used in the authorization request. Required for the authorization_code grant when the client has more than one registered redirect URI.

Example request

{
  "client_id": "<client_id>",
  "client_secret": "<client_secret>",
  "grant_type": "client_credentials",
  "redirect_uri": "https://example.com/oauth/callback"
}

Response

OAuth access token

access_tokenstring required

access token - can then be used directly to access protected endpoints

expires_ininteger required

token expiry in seconds

refresh_tokenstring nullable

token_typestring required

token type, currently always bearer

Example response

{
  "access_token": "<access_token>",
  "expires_in": 3600,
  "token_type": "bearer"
}

Changes

No recorded changes to this operation across all 8 revisions of this API.