Exchange a code, or refresh

POST

/api/oauth/token

RFC 6749 form body. Confidential clients authenticate with HTTP Basic or client_secret in the form; public clients send client_id and rely on PKCE. Every refresh returns a new refresh token; reusing an old one revokes the whole authorization.

App integration: Exchange a single-use code with its original PKCE verifier and exact redirect URI, or refresh once with the latest refresh token. Serialize refreshes and atomically persist the replacement; reusing a spent token revokes the whole authorization. Confidential clients authenticate using Basic or a form secret, never your Handwrite API key.

Request

Authorization

Basic Auth

Send your HTTP requests with an

Authorization

header that contains the word Basic followed by a space and a base64-encoded string username:password

Example:

Authorization: Basic *****************

Body Params application/x-www-form-urlencodedRequired

Responses

🟢200

application/json

Tokens (Cache-Control: no-store).

Headers

Bodyapplication/json

🟠400

🟠401

🟠429

🔴500

Request Example

Shell

JavaScript

Java

Swift

curl --location --request POST '/api/oauth/token' \
--header 'Authorization: Basic <encoded-value>'

Response Example

200 - Example 1

{
    "access_token": "string",
    "token_type": "Bearer",
    "expires_in": 0,
    "refresh_token": "string",
    "scope": "string"
}

Modified at 2026-10-26 12:58:15

OAuth API — README

Revoke a token (RFC 7009)