Exchange authorization code or refresh token

POST

/oauth/token

Exchanges an authorization code for an access token (with PKCE verification),
or refreshes an expired access token using a refresh token.

Access tokens expire after 1 hour.
Refresh tokens expire after 30 days.

Request

Body Params application/x-www-form-urlencodedRequired

Responses

🟢200OK

application/json

Token issued successfully.

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://api.opensylo.com/oauth/token' \
--data-urlencode 'grant_type=' \
--data-urlencode 'code=' \
--data-urlencode 'client_id=' \
--data-urlencode 'client_secret=' \
--data-urlencode 'redirect_uri=' \
--data-urlencode 'code_verifier=' \
--data-urlencode 'refresh_token='

Response Example

200 - Success Example

{
    "access_token": "oat_live_9f8a7b6c5d4e3f2a1b0c",
    "token_type": "Bearer",
    "expires_in": 3600,
    "refresh_token": "ort_live_1a2b3c4d5e6f7g8h9i0j",
    "scope": "data.share.sales credit.score.read repayment.report"
}

Modified at 2026-06-10 14:59:29

Start OAuth authorization

Revoke a token