OAuth

Token endpoint

grant_type=authorization_code or refresh_token. Public clients (client_id only, no client secret). Form body or JSON. An authorization code is single-use and bound to client_id, redirect_uri, and the S256 verifier. Refresh rotates the refresh token. Optional scope may only narrow the granted scope. Other grant types are unsupported_grant_type.

post/oauth/token

Request

  • Base URL: https://xn--s7y.xn--3ds443g
  • URL: https://xn--s7y.xn--3ds443g/oauth/token
  • Auth: none required

Request body

grant_type'authorization_code' | 'refresh_token' required
client_idstring required
codestring
redirect_uristring
code_verifierstring
refresh_tokenstring
scopestring

Optional. May only narrow the granted scope.

Response

Access token

access_tokenstring required
token_type'Bearer' required
expires_ininteger required

Access token lifetime in seconds (3600).

refresh_tokenstring required
scopestring required

Example response

{
  "expires_in": 3600,
  "scope": "links:read"
}

Changes

No recorded changes to this operation across all 1 revision of this API.