Get Token (OAuth 2.0)

Exchanges an authorization code for tokens, or refreshes an access token. Uses application/x-www-form-urlencoded as required by OAuth 2.0. Clients may authenticate via HTTP Basic (recommended for confidential clients) or by including client_id (and, if applicable, client_secret) in the body.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Form Data
string
enum
required
Allowed:
string
required

Authorization code from /authorize.

uri
required

Must exactly match the redirect URI used at /authorize.

string

Required if a code_challenge was used at /authorize (PKCE).

string

Client identifier (required for public clients or when not using HTTP Basic).

string

Client secret (confidential clients; omit when using HTTP Basic or for public clients).

Responses

401

Client authentication failed (confidential client)

500

Server error

Language
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json