Exchange a grant for an access token

POSThttps://api.testingapis.com/api/auth/oauth/tokenSign in to see this endpoint's URL

Body: application/x-www-form-urlencoded or JSON. Client auth: Authorization: Basic base64(client_id:client_secret), or client_id and client_secret in the body. Clients: apibee-client / apibee-secret (confidential), apibee-public (public, no secret). Users: apibee / password123, jane / jane123.

grant_type values: client_credentials: optional scope; confidential client only; no refresh token. password: username, password, optional scope. authorization_code: code, redirect_uri (if one was sent to /authorize), code_verifier (if PKCE was used). refresh_token: refresh_token. Refresh tokens rotate: each use returns a new one and the old one stops working. Using a spent refresh token again revokes every token from the same grant (reuse detection, RFC 9700). Access tokens expire after 3600 seconds.

Request body

Optional. application/x-www-form-urlencoded. Standard OAuth2 token request (JSON with the same fields also works).

Example body

grant_type=client_credentials&client_id=apibee-client&client_secret=apibee-secret&scope=read

Responses

200: access_token, token_type, expires_in, refresh_token (not for client_credentials) and scope.
400: invalid_request, invalid_grant, invalid_scope, unauthorized_client or unsupported_grant_type.
401: invalid_client: unknown client or wrong secret.

Example

Request

curl -X POST "https://api.testingapis.com/api/auth/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d 'grant_type=client_credentials&client_id=apibee-client&client_secret=apibee-secret&scope=read' \
  -H "X-TestingApis-Key: YOUR_API_KEY"

Response200 OK

Cache-Control: no-store

{
  "access_token": "oat_b10d78524a730b6c2a480d434ca733a91fc37a81",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "read"
}

The parameters, request and response examples and the live Try it panel for this endpoint are for signed-in members. Accounts are free and take a few seconds to create.

Try itSign-in requiredUses your key

api.testingapis.com

curl -X POST 'https://api.testingapis.com/api/auth/oauth/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'X-TestingApis-Key: YOUR_API_KEY' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'client_id=apibee-client' \
  --data-urlencode 'client_secret=apibee-secret' \
  --data-urlencode 'scope=read'

const res = await fetch("https://api.testingapis.com/api/auth/oauth/token", {
  method: "POST",
  headers: {
    "Content-Type": "application/x-www-form-urlencoded",
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
  body: new URLSearchParams({
    "grant_type": "client_credentials",
    "client_id": "apibee-client",
    "client_secret": "apibee-secret",
    "scope": "read",
  }),
});
console.log(res.status, await res.text());

// The shape of the example response in the docs.
type ApiResponse = {
  access_token: string;
  token_type: string;
  expires_in: number;
  scope: string;
};

const res = await fetch("https://api.testingapis.com/api/auth/oauth/token", {
  method: "POST",
  headers: {
    "Content-Type": "application/x-www-form-urlencoded",
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
  body: new URLSearchParams({
    "grant_type": "client_credentials",
    "client_id": "apibee-client",
    "client_secret": "apibee-secret",
    "scope": "read",
  }),
});
const body = (await res.json()) as ApiResponse;
console.log(res.status, body);

import requests

res = requests.post(
    "https://api.testingapis.com/api/auth/oauth/token",
    headers={
        "Content-Type": "application/x-www-form-urlencoded",
        "X-TestingApis-Key": "YOUR_API_KEY",
    },
    data={"grant_type": "client_credentials", "client_id": "apibee-client", "client_secret": "apibee-secret", "scope": "read"},
)
print(res.status_code, res.text)

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://api.testingapis.com/api/auth/oauth/token");
request.Headers.TryAddWithoutValidation("X-TestingApis-Key", "YOUR_API_KEY");
request.Content = new FormUrlEncodedContent(
[
    new("grant_type", "client_credentials"),
    new("client_id", "apibee-client"),
    new("client_secret", "apibee-secret"),
    new("scope", "read"),
]);
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder(URI.create("https://api.testingapis.com/api/auth/oauth/token"))
                .header("X-TestingApis-Key", "YOUR_API_KEY")
                .header("Content-Type", "application/x-www-form-urlencoded")
                .method("POST", HttpRequest.BodyPublishers.ofString("grant_type=client_credentials&client_id=apibee-client&client_secret=apibee-secret&scope=read"))
                .build();
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}

package main

import (
	"fmt"
	"io"
	"net/http"
	"strings"
)

func main() {
	body := strings.NewReader("grant_type=client_credentials&client_id=apibee-client&client_secret=apibee-secret&scope=read")
	req, err := http.NewRequest("POST", "https://api.testingapis.com/api/auth/oauth/token", body)
	if err != nil {
		panic(err)
	}
	req.Header.Set("X-TestingApis-Key", "YOUR_API_KEY")
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.StatusCode, string(data))
}

POSThttps://api.testingapis.com/api/auth/oauth/token

Query

Headers

Body

grant_typeclient_idclient_secretscope

Exchange a grant for an access token

Request body

Responses

Example

Related