• client_id
• code
• redirect_uri

• client_id
• client_secret

• client_id
• redirect_uri
• refresh_token

• client_id
• refresh_token

(Required)

The ID of the registered application. This is also referred to as APPID.

client_id=GGjeDjEY6kKEiDmX

(Required)

The type of grant requested.

The type of token issued is based on the grant_type values as follows:

• authorization_code—A user access_token and refresh_token are issued based on the authorization code obtained in the authorization step. Access tokens are typically short lived (approximately 30 minutes). You can get a new access_token for apps using the refresh_token obtained with this grant. Starting with the March 2022 ArcGIS Online release, support for Proof Key for Code Exchange (PKCE) has been added. PKCE is an extension to the authorization grant flow and is recommended for all apps including web apps.
• client_credentials—An app access_token is issued for the client_id specified in the request.
• exchange_refresh_token—A new refresh_token is issued by exchanging the previous refresh_token.
• refresh_token—A new access_token is issued using the refresh_token obtained above.

grant_type=authorization_code

(Required when grant_type=client_credentials)

The secret of the registered application. This is also referred to as APPSECRET.

client_secret=57e2f75cd56346bf9d5654c3338a1250

(Required when grant_type=authorization_code)

The authorization code obtained as a result of the authorization step.

code=KIV31WkDhY6XIWXmWAc6U

(Required when grant_type=authorization_code or grant_type=exchange_refresh_token)

The URI specified during the authorization step. The URIs must match; otherwise, authorization will be rejected.

redirect_uri=https://app.example.com/cb

(Required when grant_type=token or grant_type=exchange_refresh_token)

The request_token obtained in response to grant_type=authorization_code.

refresh_token=GysTpIui-oxWTTIs

The code verifier for the PKCE request that was generated before the authorization request.

If the verifier matches the expected value, the server issues an access token. Otherwise, the server responds with following error:

{
  "error": {
    "code": 400,
    "error": "invalid_request",
    "error_description": "Invalid PKCE code_challenge_verifier",
    "message": "Invalid PKCE code_challenge_verifier",
    "details": []
  }
}