Exchange an authorized request token for an access token

POSThttps://api.testingapis.com/api/auth/oauth1/access_tokenSign in to see this endpoint's URL

Exchange an authorized request token for an access token (step 3 of the three-legged flow).

Sign with apibee-consumer-key / apibee-consumer-secret plus the request token from POST /api/auth/oauth1/request_token and its secret, and include oauth_verifier from GET /api/auth/oauth1/authorize. In Postman, put the request token and secret in Access Token and Token Secret, and the verifier in Verifier.Sign with apibee-consumer-key / apibee-consumer-secret plus the request token from POST … and its secret, and include oauth_verifier from GET …. In Postman, put the request token and secret in Access Token and Token Secret, and the verifier in Verifier.

Response: application/x-www-form-urlencoded by default, or JSON when the request sends Accept: application/json. The access token works on /api/auth/oauth1 for 1 hour. Each request token can be exchanged only once.Response: application/x-www-form-urlencoded by default, or JSON when the request sends Accept: application/json. The access token works on … for 1 hour. Each request token can be exchanged only once.

OAuth 1.0a signature with the consumer credentials plus the request token and its secret

Parameters 9

Name	Type	Description
`oauth_consumer_key`required	header · string	apibee-consumer-key. In the Authorization: OAuth header, the query string or a form body (one place only).
`oauth_token`required	header · string	The request token from POST /api/auth/oauth1/request_token.The request token from POST ….
`oauth_verifier`required	header · string	The verifier from GET /api/auth/oauth1/authorize.The verifier from GET ….
`oauth_signature_method`required	header · string	HMAC-SHA1, HMAC-SHA256, HMAC-SHA512 or PLAINTEXT.
`oauth_signature`required	header · string	Signed with the request token's secret: the signing key is consumer_secret&request_token_secret. For PLAINTEXT, send that key percent-encoded (& becomes %26).
`oauth_timestamp`	header · string	Unix time in seconds, within 5 minutes of server time. Required for the HMAC methods; may be left out for PLAINTEXT.
`oauth_nonce`	header · string	A random string; each one works once. Required for the HMAC methods; may be left out for PLAINTEXT.
`oauth_version`	header · string	Optional. If sent, it must be 1.0.
`Accept`	header · string	application/json for a JSON response. Without it the response is application/x-www-form-urlencoded.

Responses

200: oauth_token, oauth_token_secret, username and oauth_expires_in (3600).
400: parameter_absent: oauth_token or oauth_verifier is missing. Or another protocol parameter problem.
401: permission_unknown (not authorized yet), parameter_rejected (wrong verifier), token_used, token_expired, token_rejected, or a signature problem.

Example

Request

curl -X POST "https://api.testingapis.com/api/auth/oauth1/access_token" \
  -H "Accept: application/json" \
  -H 'Authorization: OAuth oauth_consumer_key="apibee-consumer-key", oauth_token="{{oauth1RequestToken}}", oauth_verifier="{{oauth1Verifier}}", oauth_signature_method="PLAINTEXT", oauth_signature="apibee-consumer-secret%26{{oauth1RequestSecret}}"' \
  -H "X-TestingApis-Key: YOUR_API_KEY"

Response200 OK

{
  "oauth_token": "o1at_beca6b87b958050a30c6e3a3964c430afaaa2c32",
  "oauth_token_secret": "o1as_4323dfe2ab31282bd2b69f07bee972b14a71ffd8",
  "username": "apibee",
  "oauth_expires_in": "3600"
}

The parameters, request and response examples and the live Try it panel for this endpoint are for signed-in members. Accounts are free and take a few seconds to create.

Try itSign-in requiredUses your key

api.testingapis.com

curl -X POST 'https://api.testingapis.com/api/auth/oauth1/access_token' \
  -H 'Accept: application/json' \
  -H 'Authorization: OAuth oauth_consumer_key="apibee-consumer-key", oauth_token="{{oauth1RequestToken}}", oauth_verifier="{{oauth1Verifier}}", oauth_signature_method="PLAINTEXT", oauth_signature="apibee-consumer-secret%26{{oauth1RequestSecret}}"' \
  -H 'X-TestingApis-Key: YOUR_API_KEY'

const res = await fetch("https://api.testingapis.com/api/auth/oauth1/access_token", {
  method: "POST",
  headers: {
    "Accept": "application/json",
    "Authorization": "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"{{oauth1RequestToken}}\", oauth_verifier=\"{{oauth1Verifier}}\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26{{oauth1RequestSecret}}\"",
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
});
console.log(res.status, await res.text());

// The shape of the example response in the docs.
type ApiResponse = {
  oauth_token: string;
  oauth_token_secret: string;
  username: string;
  oauth_expires_in: string;
};

const res = await fetch("https://api.testingapis.com/api/auth/oauth1/access_token", {
  method: "POST",
  headers: {
    "Accept": "application/json",
    "Authorization": "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"{{oauth1RequestToken}}\", oauth_verifier=\"{{oauth1Verifier}}\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26{{oauth1RequestSecret}}\"",
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
});
const body = (await res.json()) as ApiResponse;
console.log(res.status, body);

import requests

res = requests.post(
    "https://api.testingapis.com/api/auth/oauth1/access_token",
    headers={
        "Accept": "application/json",
        "Authorization": "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"{{oauth1RequestToken}}\", oauth_verifier=\"{{oauth1Verifier}}\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26{{oauth1RequestSecret}}\"",
        "X-TestingApis-Key": "YOUR_API_KEY",
    },
)
print(res.status_code, res.text)

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Post, "https://api.testingapis.com/api/auth/oauth1/access_token");
request.Headers.TryAddWithoutValidation("Accept", "application/json");
request.Headers.TryAddWithoutValidation("Authorization", "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"{{oauth1RequestToken}}\", oauth_verifier=\"{{oauth1Verifier}}\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26{{oauth1RequestSecret}}\"");
request.Headers.TryAddWithoutValidation("X-TestingApis-Key", "YOUR_API_KEY");
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder(URI.create("https://api.testingapis.com/api/auth/oauth1/access_token"))
                .header("Accept", "application/json")
                .header("Authorization", "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"{{oauth1RequestToken}}\", oauth_verifier=\"{{oauth1Verifier}}\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26{{oauth1RequestSecret}}\"")
                .header("X-TestingApis-Key", "YOUR_API_KEY")
                .method("POST", HttpRequest.BodyPublishers.noBody())
                .build();
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("POST", "https://api.testingapis.com/api/auth/oauth1/access_token", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("Accept", "application/json")
	req.Header.Set("Authorization", "OAuth oauth_consumer_key=\"apibee-consumer-key\", oauth_token=\"{{oauth1RequestToken}}\", oauth_verifier=\"{{oauth1Verifier}}\", oauth_signature_method=\"PLAINTEXT\", oauth_signature=\"apibee-consumer-secret%26{{oauth1RequestSecret}}\"")
	req.Header.Set("X-TestingApis-Key", "YOUR_API_KEY")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.StatusCode, string(data))
}

OAuth 1.0a signature with the consumer credentials plus the request token and its secret

OAuth 1.0a request token{{oauth1RequestToken}}

POST /api/auth/oauth1/request_token with oauth_callback=oob, then GET /api/auth/oauth1/authorize. Each request token can be exchanged once, so get a new one after that.

OAuth 1.0a verifier{{oauth1Verifier}}

POST /api/auth/oauth1/request_token with oauth_callback=oob, then GET /api/auth/oauth1/authorize. Each request token can be exchanged once, so get a new one after that.

Request token secret{{oauth1RequestSecret}}

POST /api/auth/oauth1/request_token with oauth_callback=oob, then GET /api/auth/oauth1/authorize. Each request token can be exchanged once, so get a new one after that.

POSThttps://api.testingapis.com/api/auth/oauth1/access_token

Query

Headers

oauth_consumer_keyrequiredstring

oauth_tokenrequiredstring

oauth_verifierrequiredstring

oauth_signature_methodrequiredstring

oauth_signaturerequiredstring

oauth_timestampstring

oauth_noncestring

oauth_versionstring

Acceptstring

Exchange an authorized request token for an access token

Parameters 9

Responses

Example

Related