OAuth2 Get / Refresh Access Token

POST

/api/v1/openapi/oauth/token

Exchange an authorization_code or refresh_token for an access_token. Also supports client_credentials grant for special platforms (skip_shop_oauth=1) that can obtain tokens without merchant authorization.

Authentication: client_id + client_secret in request body

Request

Body Params application/jsonRequired

Example

{
    "grant_type": "authorization_code",
    "client_id": "trustwill",
    "client_secret": "oauth_test_secret_2026",
    "code": "6y/ly4b0PVJLCv6fafC2Xg==",
    "redirect_uri": "http://localhost:3000/oauth/callback"
}

Request Code Samples

Shell

JavaScript

Java

Swift

PHP

Python

HTTP

Objective-C

Ruby

OCaml

Dart

curl --location 'https://rapi.trustoo.io/api/v1/openapi/oauth/token' \
--header 'Content-Type: application/json' \
--data '{
    "grant_type": "authorization_code",
    "client_id": "trustwill",
    "client_secret": "oauth_test_secret_2026",
    "code": "6y/ly4b0PVJLCv6fafC2Xg==",
    "redirect_uri": "http://localhost:3000/oauth/callback"
}'

Responses

🟢200

application/json

Token issued successfully

Bodyapplication/json

Example

{
    "code": 0,
    "message": "string",
    "time": 0,
    "request_id": "string",
    "data": {
        "access_token": "string",
        "token_type": "Bearer",
        "expires_in": 3600,
        "refresh_token": "string",
        "scope": "string"
    }
}

Modified at 2026-06-24 04:25:21

Get OAuth2 Authorization URL

Revoke Token