ZEzenzap
OAuth

Issue an OAuth access token

Exchanges OAuth client credentials for a short-lived bearer access token.

Only the client_credentials grant is supported on this endpoint. Use the clientId and clientSecret returned when the bot was created (or rotated) in your Zenzap admin console.

Client authentication: either send client_id + client_secret in the form body, or use HTTP Basic Auth with the same values (Authorization: Basic base64(clientId:clientSecret)).

Scopes: omit the scope field to receive a token with all scopes configured on the bot, or pass a space-separated subset to down-scope. Requesting a scope that the bot was not granted at creation will fail.

Token lifetime: 1 hour. There is no refresh token — re-mint with the client credentials when the token expires.

Tokens are JWTs bound to the issuing region and to the bot. They are validated on every request. See Authentication for the full reference.

post/oauth/token

Request

Request body application/x-www-form-urlencoded

grant_type'client_credentials' required

OAuth 2.0 grant type. Only client_credentials is supported.

client_idstring

The bot's OAuth clientId (returned when the bot was created or rotated). Omit if you authenticate via HTTP Basic Auth.

client_secretstring

The bot's OAuth clientSecret. Omit if you authenticate via HTTP Basic Auth.

scopestring

Space-separated list of OAuth scopes to request. Optional — if omitted, the issued token receives every scope the bot was granted at creation. Passing a scope the bot was not granted will fail with invalid_grant.

Example request

{
  "client_id": "b@660e8400-e29b-41d4-a716-446655440003",
  "client_secret": "very-long-random-secret",
  "scope": "channel:list message:send"
}

Response

Access token issued

access_tokenstring required

JWT bearer token. Pass as Authorization: Bearer <access_token> on every API request.

token_type'Bearer' required

Always Bearer.

expires_ininteger required

Token lifetime in seconds (default 3600 = 1 hour).

scopestring

Space-separated list of scopes granted to this token.

Example response

{
  "expires_in": 3600,
  "scope": "channel:list message:send"
}

Changes

No recorded changes to this operation across all 1 revision of this API.