XExenforo-ltd
OAuth2

Exchange a token grant

Changed on

Exchange a token grant.

post/oauth2/token

Request

Request body application/x-www-form-urlencoded

client_idstring required
client_secretstring

Required for confidential clients.

grant_typestring required

Either 'authorization_code' or 'refresh_token'.

codestring

Required when grant_type is 'authorization_code'.

refresh_tokenstring

Required when grant_type is 'refresh_token'.

code_verifierstring

Required for public clients using PKCE with 'authorization_code' grant.

redirect_uristring

Required when grant_type is 'authorization_code'.

Response

OK

access_tokenstring
refresh_tokenstring
token_typestring

Always 'bearer'

expires_ininteger

Token lifetime in seconds

scopestring

Space-separated list of granted scopes

issue_dateinteger

Changes

  • e271d0e41f6dRevision changes
    • breaking

      request body became required

    • breaking

      removed the media type application/json from the request body

    • info

      api operation id post_oauth2_token removed and replaced with postOauth2Token

    • info

      added the new optional header request parameter XF-Api-User to all path's operations

    • info

      added the new optional query request parameter api_bypass_permissions to all path's operations

  • 61b60b0c0d52Revision changes
    • info

      api tag OAuth2 added

    • info

      api tag oauth2 removed

    • info

      added optional request body

    • info

      added the media type application/json for the response with the status