OAuth2 token endpoint (RFC 6749 /)

{ "access_token": "flowyte_oat_9x7Qp2fV8kR3nT6mB1sD4wH0aXcY5eZ", "token_type": "bearer", "expires_in": 3600, "refresh_token": "flowyte_ort_7kR2nP9xQ4mB6sD1wH8aXcY5eZ0fV3t", "scope": "webhooks:write calls:read" }

Authorizations

Authorization

string

header

required

Flowyte secret API key (Authorization: Bearer flowyte_sk_live_…). Scope-gated; is scoped to your organization — a key can never reach another tenant. The listed scopes in each operation's apiKey requirement are the scopes that key must hold. The tokenUrl is nominal: keys are minted in the dashboard.

Body

application/x-www-form-urlencoded

grant_type

enum<string>

required

Available options:

authorization_code,

refresh_token

code

string

authorization_code grant.

redirect_uri

string

authorization_code grant; must match the request.

code_verifier

string

PKCE verifier (when the code carried a challenge).

refresh_token

string

refresh_token grant.

client_id

string

client_secret_post auth.

client_secret

string

client_secret_post auth.

Response

The issued token pair (RFC 6749).

access_token

string

Example:

"flowyte_oat_…"

token_type

string

Example:

"bearer"

expires_in

integer

Example:

3600

refresh_token

string

Example:

"flowyte_ort_…"

scope

string

Example:

"webhooks:write calls:read"

Using the API

Endpoints

OAuth2 token endpoint (RFC 6749 /)

Authorizations

Body

Response