Exchange a code for a token
/v1/oauth/tokenExchanges an authorization code for a connection access token.
If your application is public, send client_id in the form body, plus the PKCE code_verifier when you
sent a code_challenge on the auth link. If it's confidential, authenticate with HTTP Basic
client_id:client_secret. The token is long-lived and doesn't
refresh; issuing a new one for the same connection revokes the previous one. An invalid, expired, or used
code returns 400 invalid_grant.
Authorization
clientBasic client_id:client_secret for confidential applications.
In: header
Request Body
application/x-www-form-urlencoded
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/v1/oauth/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d 'grant_type=authorization_code&code=string&redirect_uri=http%3A%2F%2Fexample.com'{ "access_token": "string", "token_type": "Bearer", "connection_id": "d3547de1-d1f2-4344-b4c2-17169b7526f9", "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5"}The auth link GET
The auth link. Send a user here to connect a website account to your application. The connect site, rather than the API, serves this page. It shows your application's name and icon and the website, asks the user to approve, and signs them in. It then redirects to `redirect_uri` with `code` and `state`, or with `error` (`access_denied` when the user declines, `server_error` when the sign-in fails) and `state`. An authorization expires 15 minutes after it starts; a code must be exchanged within 30 minutes. PKCE (`code_challenge` with S256) is optional for every client and recommended for public ones, because without a secret it is the only thing that ties the code exchange to the app that started it.
Revoke a token POST
Revoke a connection access token. For a public application, send its `client_id` in the form body. For a confidential application, authenticate with HTTP Basic using `client_id:client_secret`. Use the application the token belongs to. The endpoint returns `200` whether or not the token was valid. The connection itself stays; revoke it from the console to delete its saved sign-in.