Light APIv1.0.0

API / Reference / Authorization

Create access token

POST https://api.light.inc/oauth/token

Exchanges an authorization code or refresh token for an access token

Send the body as application/x-www-form-urlencoded, not JSON. Light forwards the six fields to its identity provider unchanged and returns its answer, so a rejected grant comes back with the provider's own status and body ({"error": "invalid_grant", "error_description": "..."}), not the {name, type, errors[]} envelope used elsewhere. Response keys are snake_case (access_token, expires_in in seconds, token_type, refresh_token), and refresh_token is null when the grant didn't produce one.

Authorization

Send one of these on every request. See Authentication for how to get credentials.

  • API key

    Basic authentication header of the form Basic <api_key>, where <api_key> is your api key.

  • Bearer token

Request body

application/x-www-form-urlencoded

  • client_id string

  • client_secret string

  • grant_type string

  • code string

  • redirect_uri string

  • refresh_token string

Response

  • access_token string

  • expires_in integer · int64

  • token_type string

  • refresh_token string