A valid request URL is required to generate request examples{
"access_token": "flowyte_oat_9x7Qp2fV8kR3nT6mB1sD4wH0aXcY5eZ",
"token_type": "bearer",
"expires_in": 3600,
"refresh_token": "flowyte_ort_7kR2nP9xQ4mB6sD1wH8aXcY5eZ0fV3t",
"scope": "webhooks:write calls:read"
}OAuth2 token endpoint (RFC 6749 /)
Exchanges an authorization code for a token pair, or rotates a refresh token. The confidential client authenticates via client_secret_basic (HTTP Basic) OR client_secret_post (form fields). Authorization codes are single-use; refresh tokens rotate on every use and REUSE of a spent refresh token revokes the whole token family. Errors use the RFC 6749 shape.
A valid request URL is required to generate request examples{
"access_token": "flowyte_oat_9x7Qp2fV8kR3nT6mB1sD4wH0aXcY5eZ",
"token_type": "bearer",
"expires_in": 3600,
"refresh_token": "flowyte_ort_7kR2nP9xQ4mB6sD1wH8aXcY5eZ0fV3t",
"scope": "webhooks:write calls:read"
}Authorizations
Flowyte secret API key (Authorization: Bearer flowyte_sk_live_…). Scope-gated; is scoped to your organization — a key can never reach another tenant. The listed scopes in each operation's apiKey requirement are the scopes that key must hold. The tokenUrl is nominal: keys are minted in the dashboard.
Body
authorization_code, refresh_token authorization_code grant.
authorization_code grant; must match the request.
PKCE verifier (when the code carried a challenge).
refresh_token grant.
client_secret_post auth.
client_secret_post auth.