token

The OAuth token endpoint for all access and refresh token requests. Ideally, the client should authenticate using HTTP Basic Authentication as described in the OAuth 2.0 RFC, though you can also POST the client_id and client_secret directly.

Authorization Grant: Once you've been granted an Authorization Code using the authorization endpoint (https://auth.foxy.io/authorize), POST to the token endpoint with grant_type=authorization_code&code={authorization_code}&redirect_uri={redirect_uri}. If not doing HTTP Basic Auth, also include client_id and client_secret. The response will give you your access_token and refresh_token.

Refresh Token: The OAuth endpoint for obtaining a new access_token using an existing refresh_token. Access tokens expire after 7200 seconds (2 hours) and refresh tokens expire after 315360000 seconds (10 years). POST www-form-url-encoded data as follows: grant_type=refresh_token&refresh_token={refresh_token}. If not doing HTTP Basic Auth, also include client_id and client_secret.

The token response, including both the access_token and refresh_token, should be saved in your database according to your OAuth needs.

Actions

POST Obtain or refresh an OAuth access_token

OPTIONS Get a response explaining which HTTP methods are supported

Properties (6)

grant_type String · Required

The OAuth grant type being requested.

Must be 'refresh_token' or 'authorization_code'.

refresh_tokenauthorization_code

refresh_token String · Required

The OAuth refresh token. This token is returned in the response whenever creating a client, user or store or when doing an authorization code grant.

Required for grant_type=refresh_token.

code String · Required

Authorization Code granted via the Authorization Code grant.

Required for grant_type=authorization_code.

redirect_uri String · Required

The redirect URI defined for this OAuth client. Used when doing Authorization Code grant and it must match what is stored for the OAuth client.

Required for grant_type=authorization_code.

client_id String · Required

The client_id for your FoxyCart client resource.

Required unless using HTTP Basic Auth.

client_secret String · Required

The client_secret for your FoxyCart client resource. It is much better to use HTTP Basic auth instead of passing this as a parameter.

Required unless using HTTP Basic Auth.

https://api.foxycart.com/token/{id}

Available via fx:token on api_home

Example Representation

No example representation available for this resource.