OAuth2 Token

Exchanges authorization codes for access and refresh tokens, or uses refresh tokens to obtain new access tokens. This endpoint supports multiple OAuth2 grant types including authorization_code and refresh_token flows.

Use Case: Obtain API access tokens after user authorization or refresh expired tokens to maintain continuous API access for applications.

POST /v1/oauth2/token

cURL

authorizationCode

curl --request POST \
  --url https://api.aries.com/v1/oauth2/token \
  --header 'Content-Type: application/json' \
  --data '
{
  "grant_type": "authorization_code",
  "code": "auth_code_abc123xyz789def456",
  "client_id": "client_abc123xyz",
  "client_secret": "secret_xyz789abc",
  "redirect_uri": "https://yourapp.com/callback"
}
'

200

Example

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.signature",
  "refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyZWYiOiIxMjM0NTY3ODkwIn0.signature",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token_expires_in": 2592000,
  "scope": "read write"
}

Body

application/json

Authorization Code

PKCE

Refresh Token

Use this when your app has a backend server and can safely store a client secret. Exchange a one-time authorization code for tokens by sending client_secret.

client_id · string · required

OAuth2 client identifier.

client_secret · string · required

OAuth2 client secret for confidential server-side apps.

code · string · required

Authorization code returned from the authorize or confirm flow.

grant_type · enum<string> · required

Grant type for code exchange. The backend accepts authorization_code and normalizes it internally.

Available options: code, authorization_code

Example:

"authorization_code"

redirect_uri · string · required

Redirect URI used earlier in the login flow. Must match exactly.

Example:

"https://yourapp.com/callback"

Response

200

application/json

Tokens issued successfully

OAuth2 token response. Fields may vary slightly by flow and server behavior, so response properties are documented without a required list.

access_token · string

OAuth2 access token used in the Authorization header.

refresh_token · string

Refresh token used to obtain a new access token later.

token_type · string

Token type returned by the server, typically Bearer.

Example:

"Bearer"

expires_in · integer

Access token lifetime in seconds.

Example:

3600

refresh_token_expires_in · integer

Refresh token lifetime in seconds.

Example:

2592000

scope · string

Space-separated scopes granted for this token.

Example:

"read write"