CRM Open API DocumentationCRM Open API Documentation
REST API
Webhooks
Client OAuth
PSP Open API
External Exchange Rates
REST API
Webhooks
Client OAuth
PSP Open API
External Exchange Rates
  • Client OAuth Flow
  • OAuth Applications
  • Authorization Code + PKCE

    • Authorization Code + PKCE Introduction
    • Redirect to Login
    • Get Token
    • Compute PKCE Code Challenge
    • Logout
  • Authorization Code + PKCE (Iframe)

    • Authorization Code + PKCE Introduction
    • Post Message
    • Get Token
    • Compute PKCE Code Challenge
  • Resource Owner Password Credentials (ROPC)

    • ROPC Introduction
    • Get Token
    • Verify MFA Code
    • Get MFA Secret
    • Send Email OTP for MFA
    • Bind MFA Method and enable MFA
    • Deactivate MFA
    • Forgot Password
  • Refresh Token

    • Refresh Token
    • Revoke Refresh Token

Refresh Token

Note

Please note that Refresh Token will be rotated after used

POST /oauth/token

Basic Authorization (retrieve credentials from OAuth Application)

  • Username: OAuth Client ID
  • Password: OAuth Client Secret
  • HTTP header: Authorization: Basic base64(client_id:client_secret)

Headers

  • Content-Type: application/json

Request Body

KeyTypeRequiredRuleDescription
grant_typestringMandatorymust be refresh_tokenOAuth grant type
refresh_tokenstringMandatoryrefresh token issued in previous token request

Expected HTTP status code

  • 200

Response

NameTypeDescription
access_tokenstringBearer access token
token_typestringAlways Bearer
expires_innumberToken lifetime in seconds
refresh_tokenstringRefresh token

Error

Codeerrorerror_description
400invalid_grantinvalid grant type
400invalid_grantRefresh token is invalid or expired
Last Updated: 12/8/25, 2:08 AM
Next
Revoke Refresh Token