Exchange token

Properties

access_tokenstring✻

The access token is used to authenticate requests to the API. It expires 1 hour after being issued.

1..4096 characters

Documentation

expires_innumber✻

The expires in is the number of seconds until the access token expires.

<=31536000>=0

Documentation

Example

3600

id_tokenstring✻

A JSON Web Token (JWT) containing claims about the identity and preferences of the authenticated user.
It is valid for 1 hour after being issued.

• sub — the End-User's ID. Always present.
• aud — the client ID the ID token was issued to. Always present.
• acr — the Authentication Context Class the End-User's authentication satisfied.
• auth_time — when the End-User authenticated.
• address, email, locale, name — present only if the authorization's scope includes the corresponding read permission.

1..4096 characters

Documentation

refresh_tokenstring✻

The refresh token is used to obtain a new access token. It expires 90 days after being issued and is only valid for a single use.

1..4096 characters

Documentation

scopenull | string✻

Space-delimited, case-sensitive list of <action>:<scope> permissions, such as read:name.

A client either follows the permissions the End-User has approved, or fixes a subset of them:

• omitted or empty — the authorization follows the End-User's approved permissions, so each token carries whatever they allow at the time it is issued. Consent is requested again when the app gains a permission they have not approved.
• a subset — the authorization is fixed to exactly those permissions. Requesting a permission the app is not allowed to ask for is rejected with invalid_scope, and requesting a different set later replaces the previous authorization.

Changing the requested scope replaces the authorization: any authorization code not yet redeemed, and
every refresh token previously issued to this client for this user, stop working and the End-User authorizes
again. A client that needs different scopes for different surfaces should use a client per surface.

On a refresh request, the value may only narrow what was already granted.

In a token response, this is the scope actually granted — for an authorization that follows the End-User's permissions, the set approved at that moment.

0..1024 characters/^(?:(?:(?:read|write):[\w]+ )*(?:read|write):[\w]+)?$/i

Documentation

Example

"read:name read:bloodGlucose write:bloodGlucose"

token_typestring✻

The token type is a string that indicates the type of token. The only supported token type is "Bearer".

"Bearer"

Documentation