Token endpoint | Crehana Developers

Exchanges an authorization code (with PKCE) or a refresh token for tokens. Accepts application/x-www-form-urlencoded. Confidential clients may authenticate with client_secret_post (body) or client_secret_basic (Authorization: Basic).

Authentication

Api-Keystring

API key of the organization. Always sent together with the Secret-Access header.

Request

This endpoint expects an object.

grant_typeenumRequired

An enumeration.

client_idstringOptional

codestringOptional

redirect_uristringOptional

code_verifierstringOptional

refresh_tokenstringOptional

client_secretstringOptional

Response

Successful Response

access_tokenstring

token_typestring

expires_ininteger

scopestringOptional

refresh_tokenstringOptional

id_tokenstringOptional

Errors

400

Bad Request Error

401

Unauthorized Error

422

Unprocessable Entity Error

$	curl -X POST https://qa.creha.co/api/v5/rest/auth/oauth2/token \
>	-H "Secret-Access: Secret-Access" \
>	-H "Api-Key: <apiKey>" \
>	-H "Content-Type: application/x-www-form-urlencoded" \
>	-d "grant_type=authorization_code"

1	{
2	"access_token": "eyJhbGciOiJSUzI1NiIs...",
3	"token_type": "Bearer",
4	"expires_in": 600,
5	"scope": "openid profile api-v5:read",
6	"refresh_token": "def502004f...",
7	"id_token": "eyJhbGciOiJSUzI1NiIs..."
8	}

Authentication

Headers

Request

Response

Errors