Token Exchange

After obtaining an authorization code, an access token can be requested on https://developer.mostwanted.io/api/v1/oauth/token

This request will result in an access token and a refresh token.

The refresh token can also be used on this endpoint to create a new access token and refresh token.

WARNING

The refresh token cannot be used more than once.

Request

Body Params application/x-www-form-urlencoded

client_id

string

required

Client ID of the app

client_secret

string

required

Client Secret of the app

redirect_uri

string <uri>

required

A valid, TLS secured, redirect URI

grant_type

enum<string>

required

Grant Type for the token request

Allowed values:

authorization_coderefresh_token

code

string

optional

Authorization code for the token request

refresh_token

string

optional

Refresh Token for the token request

state

string

optional

Unique state, to prevent man-in-the-middle attacks

Request samples

Shell

JavaScript

Java

Swift

PHP

Python

HTTP

Objective-C

Ruby

OCaml

Dart

Responses

🟢200Ok

application/json

Body

access_token

string <jwt>

required

Access token to authenticate with the external application

An access token is typically valid for a short period of time. The token is a JWT token,
they payload contains the exp field specifying the date and time the token will expire.

Example:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

refresh_token

string

required

Refresh token that can be used to obtain a new access_token.

Be sure to store this token securely, a refresh token ensures renewal of an expired access token.
The refresh token is valid for 1 year, and only has a single use.
Every request to the token endpoint ensures the creation of a new access token and a new refresh token.

Example:

c3f42a9a1e78b8959882840aab940356

token_type

string

required

Type of the returned token

Example:

access_token

expires_in

integer

required

Validity in seconds of the returned access token

Example:

3600

Example

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c",
  "refresh_token": "c3f42a9a1e78b8959882840aab940356",
  "token_type": "access_token",
  "expires_in": 3600
}

🟠409Conflict