Token
Three grant types.
urn:ietf:params:oauth:grant-type:device_code polls a device
authorization. Until the person approves it answers
authorization_pending; poll faster than interval and it answers
slow_down, which means widen your interval and keep it widened.
authorization_code exchanges a code from /oauth/authorize, with the
code_verifier matching the challenge you sent.
refresh_token exchanges a refresh token. The presented token is
consumed whatever happens next, so store the new one before using it.
Request Body
application/x-www-form-urlencoded
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
curl -X POST "https://internetdata.io/oauth/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d 'grant_type=string&client_id=string'{
"access_token": "string",
"token_type": "string",
"expires_in": 0,
"refresh_token": "string",
"scope": "string",
"mslm:apikey_id": "string",
"mslm:apikey": "string"
}{
"error": "string",
"error_description": "string"
}{
"error": "string",
"error_description": "string"
}Authorize GET
The browser entry point for the authorization-code flow. This is a redirect target, not something to call from code. An unknown `client_id` or an unregistered `redirect_uri` is shown to the USER and never redirected, because sending an error to an address we have not verified belongs to you is how an open redirector works. Everything else comes back to your `redirect_uri` with `error`, your `state`, and `iss`.
Revoke POST
RFC 7009. Always answers 200, including for a token that was never valid - an endpoint that distinguished the two would be a way to test whether a stolen string is a live credential. Revoking a REFRESH token ends the whole authorization and takes its access tokens with it. Revoking an access token affects only that token.