Skip to content

Create access token

Request

OAuth2 token endpoint (RFC 6749 Section 3.2). Supports the authorization_code, client_credentials, and refresh_token grant types.

Client authentication. Authenticate with HTTP Basic (Authorization: Basic base64(client_id:client_secret)) or with client_id and client_secret in the request body — not both at once (RFC 6749 Section 2.3.1).

PKCE (RFC 7636). When the authorization request included a code_challenge, the matching code_verifier is required here. A mismatch or a code_verifier for a code issued without a challenge is rejected with invalid_grant. S256 and plain challenge methods are supported.

Refresh tokens. Rotate on every use: a successful refresh_token grant retires the presented token and returns a replacement. Refresh tokens expire 30 days after issuance; rotation restarts that window. The authorization_code grant returns a refresh token only when the client is registered for the refresh_token grant type. The client_credentials grant never returns one (RFC 6749 Section 4.4.3).

Scopes. scope is space-separated per RFC 6749 (comma-separated values are additionally tolerated). Must be a subset of the scopes previously granted (authorization code or refresh token) or registered (client credentials).

Errors follow RFC 6749 Section 5.2: 400 (or 401 for invalid_client) with the standard error codes such as invalid_grant, invalid_client, unauthorized_client, unsupported_grant_type, and invalid_scope.

Bodyapplication/x-www-form-urlencodedrequired
grant_typestringrequired
The OAuth2 grant type.
Enum:"authorization_code""client_credentials""refresh_token"
client_idstring
Client identifier. Omit when authenticating with HTTP Basic.
client_secretstring
Client secret. Omit when authenticating with HTTP Basic.
codestring

The authorization code (required for authorization_code).

redirect_uristring, (uri)

Must match the redirect URI used in the authorization request. Required for authorization_code).

code_verifierstring, [ 43 .. 128 ] characters

PKCE code verifier (RFC 7636) Required when the authorization request included a code_challenge.

refresh_tokenstring

The refresh token. Required for refresh_token.

scopestring
Space-separated scopes to request. Defaults to the previously granted or registered scopes.
curl -i -X POST \
  https://rp-intranet.lab1.blueharvest.cloud/_mock/openapi/oauth2/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode grant_type=client_credentials \
  --data-urlencode client_id=client_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d \
  --data-urlencode client_secret=YOUR_CLIENT_SECRET \
  --data-urlencode 'scope=menu:read orders:read'

Responses

Token issued successfully. The response is not cacheable (it is served with Cache-Control set to no-store).

Bodyapplication/json
access_tokenstringrequired

The issued access token (opaque string).

token_typestringrequired
Type of the issued token.
Value:"Bearer"
expires_inintegerrequired
Access token lifetime in seconds.
Example:3600
refresh_tokenstring

Refresh token, returned for the authorization_code grant when the client is registered for the refresh_token grant type, and on every refresh (tokens rotate on use). Never returned for the client_credentials grant (RFC 6749 Section 4.4.3).

scopestring
Space-separated scopes granted to the token.
Example:"menu:read orders:read"
Response
{
  "access_token": "string",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "string",
  "scope": "menu:read orders:read"
}