/token: Token

authorization_code

• client_id
• code
• redirect_uri

client_credentials

• client_id
• client_secret

exchange_refresh_token

• client_id
• redirect_uri
• refresh_token

refresh_token

• client_id
• refresh_token

client_id

(Required)

The ID of the registered application. This is also referred to as APPID.

Example:

1
client_id=GGjeDjEY6kKEiDmX

grant_type

(Required)

The type of grant requested.

The type of token issued is based on the grant_type values as follows:

• authorization_code— A user access_token and refresh_token are issued based on the authorization code obtained in the authorization step. Access tokens are typically short lived (approximately 30 minutes). You can get a new access_token for apps using the refresh_token obtained with this grant. Starting with the March 2022 ArcGIS Online release, support for Proof Key for Code Exchange (PKCE) has been added. PKCE is an extension to the authorization grant flow and is recommended for all apps including web apps.
• client_credentials— An app access_token is issued for the client_id specified in the request.
• exchange_refresh_token— A new refresh_token is issued by exchanging the previous refresh_token.
• refresh_token— A new access_token is issued using the refresh_token obtained above.

Example:

1
grant_type=authorization_code

client_secret

(Required when grant_type=client_credentials)

The secret of the registered application. This is also referred to as APPSECRET.

Example:

1
client_secret=57e2f75cd56346bf9d5654c3338a1250

code

(Required when grant_type=authorization_code)

The authorization code obtained as a result of the authorization step.

Example:

1
code=KIV31WkDhY6XIWXmWAc6U

redirect_uri

(Required when grant_type=authorization_code or grant_type=exchange_refresh_token)

The URI specified during the authorization step. The URIs must match; otherwise, authorization will be rejected.

Example:

1
redirect_uri=https://app.example.com/cb

refresh_token

(Required when grant_type=token or grant_type=exchange_refresh_token)

The request_token obtained in response to grant_type=authorization_code.

Example:

1
refresh_token=GysTpIui-oxWTTIs

code_verifier

The code verifier for the PKCE request that was generated before the authorization request.

If the verifier matches the expected value, the server issues an access token. Otherwise, the server responds with following error:

1
2
3
4
5
6
7
8
9
{
  "error": {
    "code": 400,
    "error": "invalid_request",
    "error_description": "Invalid PKCE code_challenge_verifier",
    "message": "Invalid PKCE code_challenge_verifier",
    "details": []
  }
}