Get An Access Token

Implements the /token endpoint as defined in OAuth2.1.

Authentication

This endpoint uses Basic authentication. Base64 encode your client_id and client_secret, separated by a colon (:), and include it in the Authorization header of your request.

Authorization: Basic Base64(client_id:client_secret)

Grant Types

• When exchanging an authorization code for an access_token and refresh_token upon completion of an OAuth flow (e.g. User has authorized your Client to access their Profile), use the authorization_code grant type.
• When acquiring an access_token with your client_id and client_secret, use the client_credentials grant type. The acceptable scopes are institutions:read and profiles:read.
• When acquiring a new access_token for a specific profile using a refresh_token, use the refresh_token grant type. The only acceptable scope is profile:read.