Access token

Server URLloading...

POST

/api-gw/oauth/token

Send

Body

Exchange the authorization code received from the OAuth redirect callback for an access token.

Token lifetime: The returned access token is valid for 24 hours. After expiry, the token is silently rejected with a 401 Unauthorized. Re-authenticate by repeating the full authorization flow.

Re-authentication flow: GET /api-gw/oauth/authorize → user login → redirect with code → POST /api-gw/oauth/token.

Response Body

curl -X POST "https://example.com/api-gw/oauth/token" \  -H "Content-Type: application/x-www-form-urlencoded" \  -d 'code=abc123def456&client_id=xK9mP2qRtZ&client_secret=sG7nL4wVyQ&redirect_uri=https%3A%2F%2Fyourapp.com%2Fcallback&grant_type=authorization_code'

{
  "access_token": "eyJhbGciOiJSUzI1NiJ9...",
  "token_type": "bearer",
  "expires_in": 86400,
  "scope": "general"
}

{
  "s": "error",
  "msg": "Input validation failed. Kindly check your input contains required fields for the request"
}

{
  "s": "error",
  "msg": "Unauthorized"
}

{
  "s": "error",
  "msg": "Too many requests"
}

{
  "s": "error",
  "msg": "Internal server error"
}