curl --request POST \
--url https://login-demo.taxrock.com/oauth/token \
--header 'Content-Type: application/json' \
--data '
{
"grant_type": "authorization_code",
"client_id": "YOUR_CLIENT_ID",
"client_secret": "YOUR_CLIENT_SECRET",
"code": "CODE_FROM_AUTHORIZE_REDIRECT",
"redirect_uri": "http://localhost:0000",
"code_verifier": "PKCE_VERIFIER_FROM_AUTHORIZE_STEP"
}
'{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5c...",
"refresh_token": "v1.MZ8aRq3K...",
"scope": "offline_access read:client-accounts",
"expires_in": 3600,
"token_type": "Bearer"
}Get or refresh a token
POST /oauth/token
curl --request POST \
--url https://login-demo.taxrock.com/oauth/token \
--header 'Content-Type: application/json' \
--data '
{
"grant_type": "authorization_code",
"client_id": "YOUR_CLIENT_ID",
"client_secret": "YOUR_CLIENT_SECRET",
"code": "CODE_FROM_AUTHORIZE_REDIRECT",
"redirect_uri": "http://localhost:0000",
"code_verifier": "PKCE_VERIFIER_FROM_AUTHORIZE_STEP"
}
'{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5c...",
"refresh_token": "v1.MZ8aRq3K...",
"scope": "offline_access read:client-accounts",
"expires_in": 3600,
"token_type": "Bearer"
}- Exchange an authorization code (
grant_type: authorization_code). Run this once, right after a consent. Thecodeis single-use, expires in about 60 seconds, and needs thecode_verifiermatching the challenge you sent to Authorize. - Refresh an access token (
grant_type: refresh_token). Repeatable. Paste a stored refresh token to get a fresh access token. No new refresh token is returned.
client_secret from your handoff document. The access_token you
receive is the Bearer credential for the Delegate API endpoints.Body
OAuth token request. Which fields apply depends on grant_type.
Both grants: use authorization_code to exchange a code, or refresh_token to refresh.
authorization_code, refresh_token Both grants: your client ID for the environment.
Both grants: your client secret for the environment.
authorization_code grant: the single-use code from the /authorize redirect. Expires in about 60 seconds.
authorization_code grant: must match the callback registered with TaxRock.
authorization_code grant: the PKCE verifier matching the challenge sent to /authorize.
refresh_token grant: your stored refresh token.
refresh_token grant: the API audience (https://delegate.api.taxrock.com), so the new access token targets the Delegate API.
Response
Token issued.
Send as a Bearer credential to the Delegate API.
Access token lifetime in seconds (~3600).
Bearer authorization_code grant: the refresh grant returns no new refresh token, so keep using the one you have.