Get Token
| Property | Value |
|---|---|
| Method | POST |
| Path | /api/token.do |
Authentication Header
Use Authorization: Basic <BASE64_CLIENT_CREDENTIALS>, where the credentials are Base64Encode(client_id + ":" + client_secret). This endpoint does not use Bearer authentication. Base64 is not encryption: use HTTPS and keep secrets on a trusted server.
URL Parameters
The source API document specifies these as URL parameters.
| Parameter | Type | Description |
|---|---|---|
grant_type |
string | Required; authorization_code |
code |
string | Required; authorization callback code, valid for five minutes and invalid after one use, even if the exchange fails |
The source example also includes redirect_uri, but its parameter table does not specify whether it is required. Keep it consistent with the authorization request and verify against the target deployment.
Response Fields
| Field | Description |
|---|---|
access_token |
Credential for business API calls |
refresh_token |
Refresh credential; the source document specifies a 30-day lifetime |
expires_in |
Access-token lifetime in seconds; use the actual response when scheduling refreshes |
Store the latest returned credentials securely. Avoid concurrent refreshes overwriting each other; reauthorize when authentication is no longer valid. Do not expose codes or tokens in logs, monitored URLs, or screenshots. See the API overview for business-request headers; Basic authentication here does not apply to every business endpoint.