Exchange OAuth token

POST/api/oauth/accessToken

Exchange an authorization code or refresh token

Accepts JSON, form-urlencoded, or multipart form data. Confidential clients may send client_id and client_secret with HTTP Basic auth; body credentials are also accepted. The special connection_key branch exchanges a Salesforce connection refresh token for a salesforce:runtime access token.

Permission

Credentials are optional here.

HTTP Basic, using your client ID and secret.

Request body

Sent as application/json or application/x-www-form-urlencoded or multipart/form-data.

grant_typestring
One of authorization_code, refresh_token.
codestring
code_verifierstring
redirect_uristring (uri)
client_idstring
client_secretstring (password)
scopestring
refresh_tokenstring (password)
connection_keystring

Responses

200Access token issued.
access_tokenstringrequired
expires_inintegerrequired
refresh_tokenstring
scopestringrequired
token_typestringrequired
Always Bearer.
400Invalid OAuth request, grant, code, redirect URI, or grant type.
errorstringrequired
error_descriptionstring
401Invalid OAuth client credentials or access token.
errorstringrequired
error_descriptionstring
500OAuth server error.
errorstringrequired
error_descriptionstring