Rolefy

API reference / Authentication

Get an access token

POST/v1/oauth/token

No access token needed — this is the call that gets you one.

Exchanges your application's client_id and client_secret for a bearer access token that lasts one hour. Call this from your server, never from a browser or mobile app, because the secret must stay private.

Request bodyapplication/jsonrequired

  • client_idstringrequired
  • client_secretstringrequired

Responses

  • 200The access token
    Response fields
    • access_tokenstring
    • token_typestring
    • expires_ininteger

      Seconds until the token expires.

    • scopestring

      The scopes this token carries, space separated.

  • 401Wrong client_id or client_secret (invalid_client)
    Example response
    {
  "error": {
    "code": "invalid_client",
    "message": "Wrong client_id or client_secret (`invalid_client`)."
  }
}
  • 429Too many attempts (rate_limited)
    Example response
    {
  "error": {
    "code": "rate_limited",
    "message": "Too many attempts (`rate_limited`)."
  }
}