Step 3 — Exchange code for token

Overview

Request an access token from your backend using the OAuth 2.0 client credentials grant. Use this grant for server-to-server calls where your application acts as itself, not on behalf of a specific end user. There is no login step or user redirect. Because it needs your client_secret, call it only from a trusted backend — never from a browser or mobile app. Keep the client_secret on your server. The endpoint returns an access token, which you then send as a Bearer token on later requests.

Prerequisites

• No bearer token. This endpoint authenticates with your OAuth client credentials, sent in the request body.

Base URL

Endpoint

POST /oauth/token

Authentication

• No bearer token. Authenticate with your OAuth client credentials in the request body.

Rate limit

• This endpoint does not declare a rate limit.

Request body

Send the body as application/x-www-form-urlencoded.

Required parameters

Response

200 Success · 200

{
  "token_type": "Bearer",
  "expires_in": 86400,
  "access_token": "<access-token>"
}

400 Invalid grant · 400

{
  "error": "invalid_grant",
  "error_description": "The provided authorization grant is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client."
}

Errors

Example request

curl --request POST \
  --url "https://production-api.shoutaboutus.com/oauth/token" \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=client_credentials' \
  --data-urlencode 'client_id=YOUR_CLIENT_ID' \
  --data-urlencode 'client_secret=YOUR_CLIENT_SECRET'