POST /v1/oauth/token

Scope

No auth (client authentication)

Request parameters

Name	In	Type	Required	Description
grant_type	body	enum(client_credentials	authorization_code	refresh_token)
client_id	body	string	required
client_secret	body	string	optional
scope	body	string	optional
code	body	string	optional	authorization_code grant
redirect_uri	body	string	optional
code_verifier	body	string	optional	PKCE（authorization_code grant）
refresh_token	body	string	optional	refresh_token grant

Response example

{
  "access_token": "string",
  "token_type": "Bearer",
  "expires_in": 600,
  "scope": "read_items read_users",
  "refresh_token": "string"
}

Description

Token endpoint (client_credentials / authorization_code+PKCE / refresh_token)

Error response example

{
  "error": {
    "code": "insufficient_scope",
    "message": "requires scope 'read_orders'",
    "request_id": "req_01H..."
  }
}

Possible errors: 400 / 401