Skip to main content
These endpoints issue tokens and describe the API. For the resources you call with a token, see the API reference.

​
Token endpoint

Exchanges credentials for an access token. Send the body as application/x-www-form-urlencoded. The client credentials can go in the body or in an HTTP Basic header.
​
string
required
One of authorization_code, refresh_token, or client_credentials.
​
string
required
Your application client_id.
​
string
required
Your application client_secret.
​
string
Required for authorization_code. The one time code from the redirect.
​
string
Required for authorization_code. Must match the value used in the authorize request.
​
string
Required for authorization_code. The PKCE verifier that matches the challenge.
​
string
Required for refresh_token. The refresh token to rotate.
​
string
The bearer token. Valid for one hour.
​
string
Always Bearer.
​
integer
Seconds until the access token expires.
​
string
Present for authorization_code and refresh_token. Rotates on every use.
​
string
The space separated scopes the token carries.

​
Authorize endpoint

Starts the authorization code flow and shows the consent screen. See the authorization code flow for the full parameter list.

​
Version endpoint

Public and needs no token. Returns the supported API versions. See versioning.