Token Endpoint

The Token Endpoint is used by your application to exchange the authorization code for an actual access token. This is a server-to-server request (the user does not interact with this endpoint directly). Your client must authenticate itself when calling this endpoint, typically by providing its client secret, to ensure the request is secure.

Endpoint: POST /api/oauth2/Token

Purpose: Exchange an authorization code for an access token. Request Parameters (POST body):

• client_id (string, Required) – Your client identifier, as in the authorization step.

• client_secret (string, Required) – Your client secret, which is a confidential key provided when you registered your application. This secret proves to the authorization server that the request is coming from your application (and not a malicious attacker who intercepted the code).

• redirect_uri (string, Required) – The same redirect URI that was used in the authorization request. It must exactly match the URI originally provided. This is used as an additional security check: the authorization server will ensure the code was issued for this specific redirect URI.

• code (string, Required) – The authorization code received from the Authorization Endpoint redirect. This is the value of the code query parameter that was passed to your redirect URI. The code has a short expiration time and can only be used once.

• userid (string, Optional) – The user identifier, if one was included in the authorization request. You must include the same userid here to obtain a user-specific token. If you omit userid here (and the code was associated with a user), the token request will fail. Conversely, if no userid was used in the authorization step, you should not include one in this request.

Request Format: The token request is an HTTP POST. You can send the parameters as form URL-encoded (Content-Type application/x-www-form-urlencoded) or as a JSON body. The examples below demonstrate both approaches using curl and Python.