Exchange a code or rotate a refresh token

Confidential client authentication uses client_secret_basic (HTTP Basic). Account cookies and social bearer credentials do not authenticate the client. Origin may be omitted; if supplied it must match exactly. Access tokens live 300 seconds; refresh tokens 30 days. Rotation is strict: never reuse a rotated refresh token. Refresh scope cannot expand the grant.

POST /api/auth/oauth2/token

Exchange a code or rotate a refresh token

cURL

curl --request POST \
  --url https://api.sharedgraph.com/api/auth/oauth2/token \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=authorization_code \
  --data 'code=<string>' \
  --data 'redirect_uri=<string>' \
  --data 'code_verifier=<string>' \
  --data 'refresh_token=<string>' \
  --data 'scope=<string>'

200

{
  "access_token": "<string>",
  "expires_in": 123,
  "expires_at": 123,
  "token_type": "Bearer",
  "scope": "<string>",
  "refresh_token": "<string>",
  "id_token": "<string>"
}

Authorizations

Authorization · string · header · required

client_secret_basic: registered client identifier and secret.

Body

application/x-www-form-urlencoded

Option 1

Option 2

grant_type · enum<string> · required

Available options: authorization_code, refresh_token

Allowed value: "authorization_code"

code · string · required

Minimum string length: 1

redirect_uri · string<uri> · required

code_verifier · string · required

Minimum string length: 1

refresh_token · string

Minimum string length: 1

scope · string

Response

200

application/json

Successful response

access_token · string · required

Minimum string length: 1

expires_in · integer · required

expires_at · integer · required

token_type · enum<string> · required

Available options: Bearer

scope · string · required

refresh_token · string

Minimum string length: 1

id_token · string

Minimum string length: 1