/oauth/tokenThe OAuth token endpoint (RFC 6749): a code (with its PKCE verifier) or a refresh token for an access token and the next refresh token. Form-encoded. Confidential apps authenticate with HTTP Basic or client_secret; public apps send client_id. Errors are OAuth’s: { error, error_description }. A used refresh token sent again revokes every token from its authorization.
collector.oauthToken()X-Request-Idobject
grant_typeenumrequiredauthorization_code (with PKCE), or refresh_token.
authorization_coderefresh_tokencodestringauthorization_code: the code from the redirect.
at most 100 characters
redirect_uristringauthorization_code: the redirect_uri the authorization request named, exactly.
at most 500 characters
code_verifierstringauthorization_code: the PKCE verifier (43–128 characters) the challenge was made from.
at most 128 characters
refresh_tokenstringrefresh_token: the latest refresh token. It works once.
at most 100 characters
scopestringrefresh_token: fewer scopes for the new access token (space-separated). Never more.
at most 2000 characters
client_idstringThe app’s client id (with HTTP Basic, optional; if sent, it must match).
at most 30 characters
client_secretstringA confidential app’s secret, when it doesn’t use HTTP Basic.
at most 100 characters
200OKTokens.
Tokens for an app (RFC 6749 §5.1). Never cached.
access_tokenstringrequiredcat_live_…: send it as Authorization: Bearer. Lives an hour.
expires_inintegerrequiredSeconds the access token lives: 3600.
refresh_tokenstringrequiredcrt_live_…: the next refresh token. Store it before you use it: the one you sent no longer works, and sending it again revokes everything.
scopestringrequiredThe access token’s scopes, space-separated.
store_idstring (uuid) or nullrequiredinvalid_requestinvalid_grantunsupported_grant_typeinvalid_scope
invalid_request: Not form-encoded, a parameter missing or sent twice.
invalid_grant: The code or refresh token is unknown, expired, used, revoked or another app’s; the redirect URI or PKCE verifier doesn’t match.
unsupported_grant_type: Only authorization_code and refresh_token.
invalid_scope: A refresh asking for more than was granted.
invalid_client: Unknown or suspended app, a wrong or missing secret for a confidential app, or a secret from a public one.
invalid_request: The body is over 16 KiB.
rate_limited: Over the app’s limits, or too many failures from your network.
internal: Something went wrong on our side (quote the requestId).
temporarily_unavailable: This deployment isn’t set up for OAuth.