Exchange OAuth Token

POST 
/oauth/token

Exchange client credentials, an authorization code or a refresh token for an access token. The grant_type determines which other parameters are required:

• client_credentials: client_id, client_secret. Optionally scope.
• authorization_code (Sign in with mod.io): client_id, client_secret, code, redirect_uri.
• refresh_token: refresh_token, plus client_id and client_secret when the refresh token was issued to a client. Personal access tokens cannot be refreshed and must be renewed instead.

This endpoint authenticates the client via client_id and client_secret, not an api_key. A successful request will return an OAuth Token Object.

Request

Error Codes

Status Code	Error Ref	Description
400	11075	The supplied OAuth client could not be found or does not support this grant.
400	11103	First-party clients, or clients without a redirect URI, cannot use the authorization_code grant.
401	11005	The refresh token has expired or been revoked.
401	11075	The client credentials are invalid, or the refresh token was issued to a different client.
422	11146	The supplied token is not a refresh token. Personal access tokens must be renewed rather than refreshed.
429	11075	Too many token requests have been made for this OAuth client. Try again later.

See here for more details about errors.

Responses

200

Successful Request

400

The OAuth client could not be used for this grant.

401

The client credentials or refresh token were rejected.

422

The supplied token cannot be refreshed.

429

Too many token requests have been made for this OAuth client.