Get an access token

Exchange your API credentials for the token every other call needs.

POST /oauth2/token

cURL

cURL

curl -X POST "$EXSITED_BASE_URL/api/v4/oauth2/token" \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "YOUR_CLIENT_ID",
    "client_secret": "YOUR_CLIENT_SECRET",
    "redirect_uri": "YOUR_REDIRECT_URI"
  }'

200

{
  "access_token": "ACCESS_TOKEN",
  "expires_in": 3600,
  "refresh_token": "REFRESH_TOKEN"
}

Every call to the API needs an access token. Request one here with your API credentials, then send it as Authorization: Bearer ACCESS_TOKEN. The SDKs make this call for you, so you only need it for cURL, another HTTP client, or to try the API on this site. A token lasts expires_in seconds.

1. Enter your API host and credentials

   Click Try it, set host to your Exsited API host name (without https://), choose client_credentials for grant_type, and fill in your client ID, client secret and redirect URI.

2. Send the request

   The response holds access_token, refresh_token and expires_in.

3. Use the token

   On any other endpoint, click Try it, set the same host, and paste the token into Authorization.

A wrong client secret or redirect URI returns 400. An unknown client ID, or a request without grant_type, returns a redirect to the sign-in page instead of an error, and this page shows redirect to unsafe URL blocked. The SDKs report both as an authentication error. Check the client ID, client secret and redirect URI, and send again.

A new token for the same credentials ends the previous one, so an app already running with those credentials has to get a token again. Calls you make here run against your real data: creating, changing and deleting records is real. Requests are sent through Mintlify’s servers. Use test data, and never share your credentials.

Body

application/json

grant_type · enum<string> · required

client_credentials for a new token, or refresh_token to renew one.

Available options: client_credentials, refresh_token

client_id · string · required

Your integration's client ID.

client_secret · string · required

The secret paired with the client ID.

redirect_uri · string · required

The redirect URI registered for your integration. Required with client_credentials; not sent with refresh_token.

refresh_token · string

With refresh_token only: the refresh_token from an earlier token response.

Response

200

application/json

The access token.

access_token · string

Send this as Authorization: Bearer ACCESS_TOKEN.

Example:

"ACCESS_TOKEN"

expires_in · integer

Seconds until the token expires, for example 3600.

Example:

3600

refresh_token · string

Exchanged for a new access token when this one expires.

Example:

"REFRESH_TOKEN"