Get an OAuth 2.0 token#

Run the grant flow, cache the token, and share it across matching requests.

OAuth 2.0 is more involved than a pasted token. You exchange credentials for an access token, use the token until it expires, then get a fresh one. The OAuth 2.0 method runs that exchange for you and caches the token. Requests that share the same credentials reuse one token, and do not each fetch their own.

Select a grant type#

The Grant type dropdown sets the flow that fits your provider.

  • Authorization Code (with PKCE) opens your browser for sign-in, then listens locally for the redirect back. Use it for user-facing APIs. PKCE is on by default. You can turn it off for providers that do not support it.
  • Client Credentials is machine-to-machine. There is no user sign-in. The client id and secret alone fetch a token.
  • Password (Resource Owner) exchanges a username and password directly. Use it only where the provider still supports it.
  • Refresh Token exchanges a refresh token you already hold for a new access token.

Fill in the flow fields#

Every grant type asks for the Token URL, Client ID, and Client secret, plus optional Scopes and Audience. Leave the secret blank for public clients. The extra fields depend on the grant.

  • Authorization Code also asks for the Authorization URL and the PKCE setting.
  • Password also asks for a Username and Password.
  • Refresh Token also asks for the Refresh token.

As with any auth field, you can reference an environment variable with {{client_secret}} rather than type the secret in.

Get and reuse a token#

Select Get access token to run the flow. After the app caches a token, the button reads Get new token. A status line shows that the token is cached, when it expires, and its scopes. Two more controls appear when they apply: Refresh, when the cached token carries a refresh token, and Clear, to drop the cached token.

The app keys cached tokens by the token URL, client id, and scopes, so requests that share those credentials share one token. The app holds tokens in its secure storage. When you send a request, the app attaches the cached token as a bearer token.

Note Fetch a token before you send. If the app has no cached token, the request stops with a message that tells you to select Get access token first. If a token request fails, a message with a Retry action explains what went wrong.