OAuth

Authorization-code + PKCE endpoints for the Partner API.

Use these routes to discover the authorization server, issue a code, exchange it for a token, introspect, and revoke.

The sandbox walkthrough uses JSON POST /oauth/authorize, then POST /oauth/token. Do not use a browser OAuth helper that expects a redirect-only authorize URL unless you are building the hosted connect page.

Authentication guide

PKCE, scopes, token lifetime, and common errors.

Request walkthrough

Ordered sandbox calls with copy-paste bodies.

Endpoints in this group

Method	Path	Job
GET	/.well-known/oauth-authorization-server	Discovery
POST	/oauth/authorize	Issue a code (partner JSON flow)
GET	/oauth/authorize	Browser authorize page
POST	/oauth/token	Exchange or refresh
POST	/oauth/introspect	Inspect a token
POST	/oauth/revoke	Revoke a token

Access tokens last about 15 minutes. Authorization codes last about 5 minutes and are single-use. scope on authorize is a space-separated string.

Open each route in the sidebar for the playground and full schema.