Skip to main content
POST

Headers

Authorization
string
required

Basic authentication header: "Basic {Base64(client_id:client_secret)}"

Body

application/x-www-form-urlencoded

Token request for Authorization Code flow with PKCE. Requires Basic Auth header with client_id:client_secret.

grant_type
enum<string>
required

Must be "authorization_code"

Available options:
authorization_code
code
string
required

The authorization code received from the callback

redirect_uri
string
required

The same redirect_uri used in the authorization request

Example:

"clover://auth-callback"

code_verifier
string
required

The original code_verifier string used to generate code_challenge (43-128 characters)

Response

Successful token response

access_token
string

The JWT access token to use in API requests via "Authorization Bearer {token}" header

Example:

"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."

token_type
string

Token type - always "Bearer"

Example:

"Bearer"

expires_in
integer

Token lifetime in seconds (typically 3600 = 1 hour)

Example:

3600

refresh_token
string | null

Refresh token to obtain new access token when current expires (not provided for client_credentials grant)

Example:

"df8a2f3e..."

scope
string

The scopes granted by this token

Example:

"clearline_api"