These parameters must be sent as query-string GET fields.

• response_type code
  Setting response_type to code is required. Doing so will include the authorization code in the response.
• client_id Your app's client_id (obtained during app registration)
• redirect_uri Your app's URI which the user should be redirected to after authorizing

A successful response means that the user will be redirected to your whitelisted URI along with the following GET parameter:

• code A unique authorization code for a specific user

An unsuccessful response means that the user chose not to authorize your application.

• error access_denied
• error_description The user denied access to this application.

Note that the redirect_uri you provide must match one of the URIs in your registered application's whitelist. If you'd like to update this whitelist, click the corresponding [Edit] link for your application on the My Applications page. You'll find the whitelist options in the Publishing Options dropdown.

These parameters may be sent via GET or POST

• client_id Your app's client_id (obtained during app registration)
• client_secret Your app's client_secret (obtained during app registration)
• grant_type authorization_code or refresh_token
  authorization_code is the default grant_type and is used to obtain a brand new token.
  Since tokens have an expiration, refresh_token is used to obtain subsequent tokens.
  It's advised to use authorization_code to get your first access_token, and then refresh_token to get all subsequent tokens. You can obtain a new token via refresh_token at any time, regardless of expiration.
• code The code query-string parameter obtained by the authorization redirect
  This is only required if grant_type is set to authorization_code
• refresh_token The refresh_token obtained by a previous /token call.
  This is used to generate new tokens afer using grant_type of authorization_code to obtain your first token.
  It must match the refresh_token field obtained by the most recent call to /token.
  It is only required if grant_type is set to refresh_token.

A successful token call will return a JSON-encoded token that you can then use to make API calls.

{
  "expires_in": 3600,
  "status": "success",
  "access_token": "Alph4num3r1ct0k3nv4lu3",
  "refresh_token": "0123456789"
}

An unsuccessful response will return an HTTP 400 - Bad Request or an HTTP 401 - Unauthorized, optionally with one of the following JSON responses:

{
  "status": "error",
  "error": "access_denied",
  "error_description": "Access to this oAuth2 resource is denied, invalid client_secret."
}

{
  "status": "error",
  "error": "unsupported_grant_type",
  "error_description": "Only authorization_code and refresh_token are supported for access grant."
}

{
  "status": "error",
  "error": "invalid_code",
  "error_description": "Access code must be numeric"
}

{
  "status": "error",
  "error": "invalid_grant",
  "error_description": "Invalid access code."
}

{
  "status": "error",
  "error": "invalid_request",
  "error_description": "refresh_token must be specified"
}

{
  "status": "error",
  "error": "invalid_grant",
  "error_description": "Invalid refresh token."
}