Documentação - Documentação

post https://console.iugu.com/token

OAuth2 token endpoint

Exchanges an authorization grant for an access token. Supports the authorization_code, client_credentials and refresh_token grant types. Clients authenticate with HTTP Basic or by sending client_id and client_secret in the body. PKCE is supported via code_verifier.

Sem ações implementadas definidas

Request

Body Required

Content Type: application/x-www-form-urlencoded

grant_type

String
Enum: `authorization_code`, `client_credentials`, `refresh_token`

The OAuth2 grant type.

code

String

Authorization code (grant_type=authorization_code).

redirect_uri

String

Must match the redirect_uri from the authorization request.

Ex: https://app.example.com/callback

code_verifier

String

PKCE code verifier (grant_type=authorization_code).

refresh_token

String

The refresh token (grant_type=refresh_token).

client_id

String

The application (client) short ID, when not using HTTP Basic.

Ex: 4fHECmQtLdROI4fDLWMiLd

client_secret

String

The client secret, when not using HTTP Basic.

scope

String

Space separated list of requested scopes.

Ex: informations

audience

String

Intended audience for the issued token.

Ex: Iugu.Platform.3W3pZX7CxbPGjC8WDTmunA

Example

1
{}

Response

200

Success

access_token

String

The issued JWT access token.

id_token

String

The issued JWT ID token (authorization_code and refresh_token grants).

refresh_token

String

The issued refresh token, when the grant scope allows it.

token_type

String

Ex: Bearer

expires_in

Integer

Access token lifetime in seconds.

Ex: 300

scope

String

Granted scope.

Ex: informations

Example

1
2
3
4
5
6
7
8
{
  "access_token": "<ACCESS_TOKEN>",
  "id_token": "<ID_TOKEN>",
  "refresh_token": "<REFRESH_TOKEN>",
  "token_type": "Bearer",
  "expires_in": 300,
  "scope": "informations"
}

400

Bad Request

error_type

String

The OAuth2 error type.

Ex: invalid_client

error_description

String

Human readable error message.

Ex: The client is unregistered or could not be authenticated

Example

1
2
3
4
{
  "error_type": "invalid_client",
  "error_description": "The client is unregistered or could not be authenticated"
}

401

Unauthorized

error_type

String

The OAuth2 error type.

Ex: invalid_client

error_description

String

Human readable error message.

Ex: The client is unregistered or could not be authenticated

Example

1
2
3
4
{
  "error_type": "invalid_client",
  "error_description": "The client is unregistered or could not be authenticated"
}

Back

OAuth2 authorization endpoint

Forward

Verify principal authorizations