Authentication API

These endpoints implement the OAuth 2.0 authorization code flow for applications created under My Account > Developer > OAuth Clients.

Authorization Request

Method URI
GET /oauth/authorize

Send the member's browser to this address. The member signs in and approves your application, and is then redirected to your redirect URL.

URL Params

{
    "client_id": "{client_id}",
    "redirect_uri": "{redirect_url}",
    "response_type": "code",
    "scope": "*",
    "state": "{random_state}"
}

{info} The redirect to your redirect URL includes a code in the query string. Check that state matches what you sent, then exchange the code for a token as shown below.

Request an Access Token

Method URI
POST /oauth/token

Form Params

{
    "grant_type": "authorization_code",
    "client_id": "{client_id}",
    "client_secret": "{client_secret}",
    "redirect_uri": "{redirect_url}",
    "code": "{code}"
}

Response

{
    "token_type": "Bearer",
    "expires_in": 1209600,
    "access_token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...",
    "refresh_token": "def50200014f3f27858ab9446214f089d26..."
}

Access tokens expire after 14 days (expires_in is in seconds). Refresh tokens expire after 30 days.

Refresh an Access Token

Method URI
POST /oauth/token 
{
    "grant_type": "refresh_token",
    "refresh_token": "{refresh_token}",
    "client_id": "{client_id}",
    "client_secret": "{client_secret}",
    "scope": "*"
}

The response has the same shape as above, with a new access token and a new refresh token.

Personal Access Tokens

For your own scripts, you can skip the OAuth flow. Create a token under My Account > Developer > Personal Access Tokens and send it as Authorization: Bearer {token}. Personal access tokens expire after 60 days; create a new one before then.