Exchange code or refresh token

POST

/oauth/token

Exchange an authorization code for tokens (grant_type=authorization_code) or refresh an expired access token (grant_type=refresh_token). Access tokens are valid for 1 hour; refresh tokens for 30 days. Refresh tokens are NOT rotated.

Request

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

Tokens issued

Bodyapplication/json

🟠401Unauthorized

Request Example

Shell

JavaScript

Java

Swift

cURL

Exchange authorization codeRefresh access token

curl --location '/oauth/token' \
--header 'Content-Type: application/json' \
--data '{
    "grant_type": "authorization_code",
    "code": "auth_code_abc123",
    "client_id": "yourmarketplace_client_a1b2c3d4",
    "client_secret": "cs_secret_your_secret",
    "redirect_uri": "https://yourmarketplace.com/oauth/callback",
    "code_verifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
}'

Response Example

200 - Success Example

{
    "access_token": "opaque_access_token",
    "token_type": "Bearer",
    "expires_in": 3600,
    "refresh_token": "opaque_refresh_token",
    "scope": "data.share.sales data.share.profile credit.score.read"
}

Modified at 2026-04-08 17:24:40

Start OAuth authorization

Revoke a token