Token endpoint

POST

/api/oauth/token

RFC 6749 §3.2 token endpoint. Body is application/x-www-form-urlencoded
per the RFC, not this API's own JSON convention. Supports two grant
types (grant_type selects which field set is required):

authorization_code: exchange a code from /oauth/authorize for a
token pair. Requires code, redirect_uri, client_id, and the
PKCE code_verifier (43–128 chars). A code is single-use and
expires after 60 seconds.

refresh_token: exchange a refresh token for a new pair. Requires
refresh_token. Rotates on every use: presenting an already-used
refresh token revokes every live token (access and refresh) sharing
its family, since it can no longer be told apart from a stolen copy
being replayed.

Response is never cached (Cache-Control: no-store).

Request

Authorization

API Key

Add parameter in header

x-api-key

Example:

x-api-key: ********************

Bearer Token

Provide your bearer token in the

Authorization

header when making requests to protected resources.

Example:

Authorization: Bearer ********************

Body Params application/x-www-form-urlencodedRequired

Responses

🟢200OK

application/json

A fresh access + refresh token pair.

Headers

Bodyapplication/json

🟠400Bad Request

🟠429

🔴500Server Error

Request Example

Shell

JavaScript

Java

Swift

curl --location 'https://upload.tf/api/v1/api/oauth/token' \
--header 'x-api-key: <api-key>' \
--data-urlencode 'grant_type=' \
--data-urlencode 'code=' \
--data-urlencode 'redirect_uri=' \
--data-urlencode 'client_id=' \
--data-urlencode 'code_verifier=' \
--data-urlencode 'refresh_token='

Response Example

200 - Example 1

{
    "access_token": "utf_at_…",
    "token_type": "Bearer",
    "expires_in": 3600,
    "refresh_token": "utf_rt_…",
    "scope": "sites:read sites:write"
}

Modified at 2026-08-07 15:42:15

Consent decision (internal, not a public integration point)

Revocation endpoint