Token endpoint

curl --request POST \
  --url https://app.sideshift.app/api/oauth/v1/token \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=authorization_code \
  --data code=ac_4f2b... \
  --data redirect_uri=https://acme.example.com/oauth/callback \
  --data code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk \
  --data client_id=oauthc_8f1c2e...

{
  "access_token": "eyJhbGciOiJFUzI1NiIsImtpZCI6Ii4uLiIsInR5cCI6ImF0K2p3dCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "campaigns:read contracts:read",
  "refresh_token": "rt_9f8e..."
}

{
  "error": "invalid_grant",
  "error_description": "Authorization code is invalid or expired"
}

{
  "error": "invalid_client",
  "error_description": "Client authentication failed"
}

{
  "error": "subscription_required",
  "error_description": "The company does not have an active subscription"
}

{
  "error": "temporarily_unavailable",
  "error_description": "Rate limit exceeded"
}

POST

token

curl --request POST \
  --url https://app.sideshift.app/api/oauth/v1/token \
  --header 'Authorization: Basic <encoded-value>' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=authorization_code \
  --data code=ac_4f2b... \
  --data redirect_uri=https://acme.example.com/oauth/callback \
  --data code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk \
  --data client_id=oauthc_8f1c2e...

{
  "access_token": "eyJhbGciOiJFUzI1NiIsImtpZCI6Ii4uLiIsInR5cCI6ImF0K2p3dCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "campaigns:read contracts:read",
  "refresh_token": "rt_9f8e..."
}

{
  "error": "invalid_grant",
  "error_description": "Authorization code is invalid or expired"
}

{
  "error": "invalid_client",
  "error_description": "Client authentication failed"
}

{
  "error": "subscription_required",
  "error_description": "The company does not have an active subscription"
}

{
  "error": "temporarily_unavailable",
  "error_description": "Rate limit exceeded"
}

Authorizations

Authorization

string

header

required

Confidential-client authentication at the token/revoke endpoints — HTTP Basic client_id:client_secret (or the equivalent client_secret_post body params). Public (PKCE) clients send only client_id and use no scheme.

Body

application/x-www-form-urlencoded

Form-encoded token request. Fields apply per grant_type: authorization_code uses code + redirect_uri + code_verifier; refresh_token uses refresh_token; client_credentials uses scope. Public clients also send client_id.

grant_type

enum<string>

required

Available options:

authorization_code,

refresh_token,

client_credentials

code

string

redirect_uri

string<uri>

code_verifier

string

PKCE verifier (authorization_code grant).

refresh_token

string

scope

string

resource

string<uri>

RFC 8707 resource indicator.

client_id

string

client_secret

string

client_secret_post auth (alternative to HTTP Basic).

Response

Token issued.

RFC 6749 / 9068 token response.

access_token

string

required

RFC 9068 at+jwt

token_type

enum<string>

required

Available options:

Bearer

expires_in

integer

required

Seconds until expiry (3600).

scope

string

refresh_token

string

Present when the client registered the refresh_token grant. The optional OIDC offline_access scope is not required.

⌘I

OAuth 2.1 & MCP

API key

Authorizations

Body

Response