Exchange a developer-client authorization code or refresh token
Exchange a developer-client authorization code or refresh token
POST/api/v1/dev/oauth/token
Exchanges one bound authorization code and PKCE verifier, or rotates
the current refresh token. Access tokens expire after 15 minutes.
Refresh families expire after 90 days of inactivity and one year
absolutely; replay of a consumed refresh token revokes the family.
No client secret is accepted.
Request Body
application/x-www-form-urlencoded
Responses
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
access_tokenRequired
string <password>·min 50·max 128
refresh_tokenRequired
string <password>·min 50·max 128
token_typeRequired
string·const Bearer
expires_inRequired
integer·const 900
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
X-Request-ID
string·min 1·max 200
Correlation identifier for the request.
X-Content-Type-Options
string·const nosniff
Prevents user agents from MIME-sniffing the response.
errorRequired
object
Cache-Control
string·const no-store
Prevents storage of error responses by clients and intermediaries.
X-Request-ID
string·min 1·max 200
Correlation identifier for the request.
X-Content-Type-Options
string·const nosniff
Prevents user agents from MIME-sniffing the response.
