Authentication
Token endpoints on this host.
Generate Token
Exchange OAuth app credentials for a bearer token pair (access_token + refresh_token) — returns both in one call.
grant_type: "authorization_code" — first-time exchange, right after the user approves your app. Requires code (from the authorization redirect) and redirect_uri (must match the one used to obtain that code).
grant_type: "refresh_token" — mint a fresh token pair once the access token nears expiry, without asking the user to re-approve. Requires refresh_token (from a prior call to this endpoint).
Both grant types also require client_id and client_secret, sent either as the request body fields or as HTTP Basic auth (Authorization: Basic base64(client_id:client_secret)).
The resulting access_token authenticates like any bearer token — Authorization: Bearer <access_token> — on both the v1.0 and v3 APIs.
Headers
authorizationThe string Basic with your Client ID and Client Secret separated with colon (:), Base64-encoded. For example, Client_ID:Client_Secret Base64-encoded is Q2xpZW50X0lEOkNsaWVudF9TZWNyZXQ=.
Generate Token › Request Body
grant_typegrant_type
codeAuthorization code from the authorize redirect. Required for grant_type=authorization_code.
client_idOAuth app client id. Send it here or as the username half of HTTP Basic auth.
client_secretOAuth app client secret. Send it here or as the password half of HTTP Basic auth.
refresh_tokenRefresh token from a previous call to this endpoint. Required for grant_type=refresh_token.
redirect_uriMust match the redirect_uri the code was obtained with. Required for grant_type=authorization_code.
Generate Token › Responses
The refresh and access token pair.
access_tokenAccess Token
token_typeToken Type
refresh_tokenRefresh token
expires_inExpires in seconds
scopeScope
Authorize (browser entry point)
The OAuth 2.1 authorization endpoint (RFC 8414 authorization_endpoint).
Redirect the end user's browser here to start the interactive consent
flow — this is not an endpoint your application code calls directly.
Returns a 302 to the Nifty consent screen; after the user approves or
denies, they land back on your redirect_uri with either a code or
an error query parameter.
query Parameters
redirect_uriWhere to send the user back to. Must be one of the app's registered redirect URLs.
client_idClient id of your OAuth app.
response_typeAlways code — Nifty implements the authorization-code flow.
code_challenge_methodPKCE challenge method; use S256.
code_challengePKCE challenge derived from your code verifier (RFC 7636).
stateOpaque value echoed back on the redirect; use it to defend against CSRF.
scopeSpace-separated scopes to request.
Authorize (browser entry point) › Responses
Redirects to the consent screen.