Get token (password grant)

Overview

Exchanges a user's email and password for an access token plus a refresh token. This uses the OAuth 2.0 Resource Owner Password Credentials grant. Use it for user authentication in trusted applications. For server-to-server integrations, use the client credentials grant instead.

Prerequisites

• No bearer token. This endpoint authenticates with your OAuth client credentials, sent in the request body.

Base URL

Endpoint

POST /oauth/token

Authentication

• No bearer token. Authenticate with your OAuth client credentials in the request body.

• Send no Authorization header. The request authenticates itself with two credential pairs in the body. These are your OAuth client credentials (client_id + client_secret) and the end user's credentials (username + password).

• Obtain client_id and client_secret from an administrator; the secret is shown once at client creation and cannot be retrieved afterwards.

Rate limit

• 60 requests/min per IP.

Request body

Send the body as application/x-www-form-urlencoded.

Password grant

Refresh token grant

How it works

• 200 returns access_token, refresh_token, token_type (Bearer) and expires_in (seconds). Send the access token as an Authorization: Bearer <bearer-token> header on subsequent calls. Exchange the refresh token by calling POST /oauth/token again with grant_type=refresh_token and the refresh_token parameter once the access token expires.
• 400 invalid_grant when the user credentials are wrong; 401 invalid_client when the client credentials are wrong.

Response

200 Success · 200

{
  "token_type": "Bearer",
  "expires_in": 86400,
  "access_token": "<access-token>",
  "refresh_token": "<refresh-token>"
}

400 Invalid credentials · 400

{
  "error": "invalid_grant",
  "error_description": "The user credentials were incorrect."
}

Errors

Example request

curl --request POST \
  --url "https://production-api.shoutaboutus.com/oauth/token" \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode 'grant_type=password' \
  --data-urlencode 'client_id={{oauthClientId}}' \
  --data-urlencode 'client_secret={{oauthClientSecret}}' \
  --data-urlencode 'username={{email}}' \
  --data-urlencode 'password={{password}}' \
  --data-urlencode 'scope=*'