Skip to content

OAuth Token Endpoint

POST
/v1/oauth/token

Endpoint for receiving access, ID, and refresh tokens from Bolt's OAuth server.

To use this endpoint, first use the Authorization Code Request flow by using the authorization_code Grant Type (grant_type). Then, in the event that you would need a second or subsequent code, use the refresh_token value returned from a successful request as the refresh_token input value in your subsequent refresh_token Grant Type (grant_type) request.

Reminder - the Content-Type of this request must be application/x-www-form-urlencoded

Authorization

X-API-Key<token>

Admins and Developers can obtain their Bolt API key from the Bolt Merchant Dashboard.

In: header

Header Parameters

X-Publishable-Key?string

The publicly viewable identifier used to identify a merchant division. This key is found in the Developer > API section of the Bolt Merchant Dashboard [RECOMMENDED].

Request Body

application/x-www-form-urlencoded

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/v1/oauth/token" \  -H "Content-Type: application/x-www-form-urlencoded" \  -d 'client_id=PUBLISHABLE_KEY_PLACEHOLDER&client_secret=API_KEY_PLACEHOLDER&code=AUTH_CODE_PLACEHOLDER&grant_type=authorization_code&scope=bolt.account.manage%2Bopenid'

{  "access_token": "$ACCESS_TOKEN",  "expires_in": 3600,  "id_token": "$ID_TOKEN",  "refresh_token": "$REFRESH_TOKEN",  "refresh_token_scope": "bolt.account.view",  "scope": "bolt.account.manage",  "token_type": "bearer"}