Skip to main content
POST

Body

application/x-www-form-urlencoded

One form, three grants. grant_type decides which of the other fields matter, and the examples above fill in each one — pick the grant you are using rather than working it out from this list.

grant_type
enum<string>
required
Available options:
client_credentials,
authorization_code,
refresh_token
client_id
string
required
client_secret
string

Every grant, for every client we hand out to a partner or a seller. Only the Wristler app has no secret, because a secret it could ship is not a secret; how it signs in is in the app's own pages.

scope
string

Space-separated, and asked for rather than assumed — a token carries nothing you did not name. Never wider than the token you are refreshing.

redirect_uri
string<uri>

authorization_code only. The same URI you sent to the authorization endpoint.

code
string

authorization_code only. What came back on your redirect URI.

code_verifier
string

authorization_code only. The PKCE verifier whose challenge you sent to the authorization endpoint.

refresh_token
string

refresh_token only.

Response

A token, and a refresh token when the flow produces one.

token_type
string
required
Allowed value: "Bearer"
expires_in
integer
required

Seconds. One hour.

Example:

3600

access_token
string
required
refresh_token
string

Absent for client credentials, which can simply ask again.