Exchange or Refresh a WordPress OAuth Token

Exchange a single-use authorization code and PKCE verifier, or rotate a valid refresh token. Access tokens expire after fifteen minutes, refresh tokens rotate on every use, and token responses must never be cached or logged.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

grant_type*string

client_id*string

code*string

code_verifier*string

Length43 <= length <= 128

redirect_uri*string

Formaturi

Response Body

`application/json`

curl -X POST "https://example.com/api/v1/integrations/wordpress/oauth/token" \  -H "Content-Type: application/json" \  -d '{    "grant_type": "authorization_code",    "client_id": "docs_wordpress_client",    "code": "docs_single_use_code",    "code_verifier": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",    "redirect_uri": "https://music.example.invalid/wp-admin/admin-post.php?action=spacemedia_oauth_callback"  }'

{  "token_type": "Bearer",  "access_token": "docs_wordpress_access_token",  "expires_in": 900,  "refresh_token": "docs_wordpress_refresh_token",  "scope": "catalog.read",  "account_label": "Example Catalog Manager"}

Request Body

Response Body

200application/json

400

429application/json

500application/json

`application/json`

`application/json`

`application/json`