increase-test
POST/oauth/tokens

Create an OAuth token

Creates an OAuth token for an application after a user completes the OAuth flow. Supply grant_type and the corresponding credentials; in production, use authorization_code, while sandbox also supports production_token. Use the returned access_token to authenticate requests on the user's behalf.

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

5 body fields

OAuth token exchange credentials. grant_type is required.

client_idstringoptional
The public identifier for your application.
client_secretstringoptional
The secret that confirms you own the application. This is redundant given that the request is made with your API key but it's a required component of OAuth 2.0.
codestringoptional
The authorization code generated by the user and given to you as a query parameter.
grant_typestringrequired
The credential you request in exchange for the code. In Production, this is always `authorization_code`. In Sandbox, you can pass either enum value.
Allowed:authorization_codeproduction_token
production_tokenstringoptional
The production token you want to exchange for a sandbox token. This is only available in Sandbox. Set `grant_type` to `production_token` to use this parameter.

3 status codes
200Returns the OAuth token with its `access_token`, `group_id`, `token_type`, and resource type.
access_tokenstringrequired
You may use this token in place of an API key to make OAuth requests on a user's behalf.
group_idstringrequired
The Group's identifier. A Group is the top-level organization in Increase.
token_typestringrequired
The type of OAuth token.
Allowed:bearer
typestringrequired
A constant representing the object's type. For this resource it will always be `oauth_token`.
Allowed:oauth_token
4XXReturned when the request cannot be processed because of a client-side error.
5XXReturned when the request cannot be processed because of a server-side error.

Error handling

grant_type is required and must be authorization_code or production_token. When supplied, client_id, client_secret, code, and production_token must each contain between 1 and 200 characters; use production_token only with the production_token grant type.