POST /oauth/token

Used to acquire a new access token or refresh an existing access token. Certain parameter combinations and values are used depending on which scenario you are handling. See the individual parameter descriptions for additional information. This endpoint corresponds to the token endpoint described in section 3.2 of the OAuth 2.0 RFC. See the Authentication Guide for additional information and authentication examples. JavaScript applications cannot make this request to get the access token or refresh token.

Servers

Request headers

Name Type Required Description
Content-Type String Yes The media type of the request body.

Default value: "application/json"

Request body fields

Name Type Required Description
client_id String Yes

Client ID you were assigned when you registered your application.

client_secret String Yes

Client Secret you were assigned when you registered your application.

grant_type String Yes

Use the value authorization_code when getting a new access token. Use refresh_token when refreshing an existing access token. Use client_credentials when using a Procore Service Account for authentication.

Possible values:

  • "refresh_token"
  • "authorization_code"
  • "client_credentials"
code String No

Value of the authorization_code retrieved from the /oauth/authorize call. Only required when getting a new access code.

redirect_uri String No

The URI that the user will be redirected to after they grant authorization to your application. For browser-based web applications, use a https:// web address. For "headless" applications use urn:ietf:wg:oauth:2.0:oob.

refresh_token String No

The refresh token string. Only required when refreshing an access token.

How to start integrating

  1. Add HTTP Task to your workflow definition.
  2. Search for the API you want to integrate with and click on the name.
    • This loads the API reference documentation and prepares the Http request settings.
  3. Click Test request to test run your request to the API and see the API's response.