Generate Token
Exchange OAuth app credentials for a bearer token pair (access_token + refresh_token) — returns both in one call.
grant_type: "authorization_code" — first-time exchange, right after the user approves your app. Requires code (from the authorization redirect) and redirect_uri (must match the one used to obtain that code).
grant_type: "refresh_token" — mint a fresh token pair once the access token nears expiry, without asking the user to re-approve. Requires refresh_token (from a prior call to this endpoint).
Both grant types also require client_id and client_secret, sent either as the request body fields or as HTTP Basic auth (Authorization: Basic base64(client_id:client_secret)).
The resulting access_token authenticates like any bearer token — Authorization: Bearer <access_token> — on both the v1.0 and v3.0 APIs.
Headers
authorizationThe string Basic with your Client ID and Client Secret separated with colon (:), Base64-encoded. For example, Client_ID:Client_Secret Base64-encoded is Q2xpZW50X0lEOkNsaWVudF9TZWNyZXQ=.
Generate Token › Request Body
codeCode will be come from the authorize url call back redirect url.
refresh_tokenRefresh Token
grant_typegrant_type
redirect_uriRedirect URI
Generate Token › Responses
The refresh and access token pair.
access_tokenAccess Token
token_typeToken Type
refresh_tokenRefresh token
expires_inExpires in seconds
scopeScope
Authorize (browser entry point)
The OAuth 2.1 authorization endpoint (RFC 8414 authorization_endpoint).
Redirect the end user's browser here to start the interactive consent
flow — this is not an endpoint your application code calls directly.
Returns a 302 to the Nifty consent screen; after the user approves or
denies, they land back on your redirect_uri with either a code or
an error query parameter.