Token Endpoint

post

https://openapi.tigerfintech.com/oauth2/v1/token

The App's Server fetches tokens.

NOTE

Content-Type MUST be application/x-www-form-urlencoded;
The App MUST authenticate itself, via either Secret Basic or Secret Post method;
access_token is JSON Web Token;
When the grant type is client_credentials, the sub payload claim of access_token is client:{client_id};
Content-Type of the response is application/json;charset=UTF-8;
For explanation of errors, please refer to Section 5.2 of RFC6749.

Example

Authorization Code Grant Type

grant_type: authorization_code
code: yfz_7OBH9Eektoyb70GKcRTqmnshAQuolLqNzr63Vgs.z4591d8Yg9m7-KcygngZ9kO38rpGvdde7jjHKhLDM08
redirect_uri: 'http://localhost:3846/callback'

Refresh Token Grant Type

grant_type: refresh_token
refresh_token: YU7w7bnP9dfp5-TBKTXRaPPT0BvkgSag5xHyGVVMo80.UL6_E30Zxk1F5GwQT2VzQLKr19c1HobG9MkdBDdi4LM

Client Credentials Grant Type

grant_type: client_credentials
scope: api.users:write
audience: openapi

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Form Data

grant_type

string

enum

required

Grant type,
see RFC6749

Value	Description
`authorization_code`	Authorization Code
`refresh_token`	Refresh Token
`client_credentials`	Client Credentials

Allowed:

code

string

The authorization code that the App received at the Authorization Endpoint, required when grant_type=authorization_code

redirect_uri

uri

When grant_type=authorization_code, required if the redirection URL was included in the initial authorization request. The redirection URL in the token request must EXACTLY match the redirection URL that was used when generating the Authorization Code.

refresh_token

string

Refresh Token, required when grant_type=refresh_token.

scope

string

Indicating accesses requested by the App, concatenate multiple scopes with ' '. Required when grant_type=client_credentials, otherwise ignored.

audience

string

Indicating audiences requested by the App, concatenate multiple audiences with ' '. Required when grant_type=client_credentials, otherwise ignored.

client_id

string

Used by Secret Post authentication method

client_secret

string

Used by Secret Post authentication method

Responses

200OK

400Bad Request

401Unauthorized