POST /v1/oauth/token

Scope

No auth (client authentication)

Name	In	Type	Required	Description
`grant_type`	body	enum(client_credentials	authorization_code	refresh_token)
`client_id`	body	string	required	The client ID you were issued.
`client_secret`	body	string	optional	Client secret (required for confidential clients). Do not call this from a browser.
`scope`	body	string	optional	Requested scopes, space separated. Omit to receive the client's default scopes.
`code`	body	string	optional	authorization_code grant
`redirect_uri`	body	string	optional	For `authorization_code`, the exact value used in the authorization request.
`code_verifier`	body	string	optional	PKCE（authorization_code grant）
`refresh_token`	body	string	optional	refresh_token grant

{
  "access_token": "string",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "read_items read_users",
  "refresh_token": "string"
}

Token endpoint (client_credentials / authorization_code+PKCE / refresh_token)

{
  "error": {
    "code": "invalid_request",
    "message": "malformed request",
    "request_id": "req_01H..."
  }
}

Possible errors: 400 / 401