OAuth2 token endpoint
Issues an access token. Supports `client_credentials` (an operator's own backend), `authorization_code` + PKCE (marketplace apps; 2-hour access tokens, rotating refresh tokens), and `refresh_token`. Client authenticates with `client_id`/`client_secret`. See conventions.md.
Issues an access token. Supports client_credentials (an operator's own backend), authorization_code + PKCE (marketplace apps; 2-hour access tokens, rotating refresh tokens), and refresh_token. Client authenticates with client_id/client_secret. See conventions.md.
Request Body
application/x-www-form-urlencoded
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
curl -X POST "https://example.com/oauth/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d 'grant_type=client_credentials'{ "access_token": "sb_at_1f2e3d…", "token_type": "Bearer", "expires_in": 7200, "scope": "string", "refresh_token": "string"}{ "error": "invalid_grant", "error_description": "string"}{ "error": "invalid_grant", "error_description": "string"}OAuth2 authorization endpoint GET
Starts the authorization-code + PKCE flow for marketplace apps acting on behalf of an operator. On approval, redirects to `redirect_uri` with a short-lived `code` (and the `state`). PKCE (`S256`) is required.
Cancel an import job POST
A pending or processing import job is cancelled.