Authorization code flow

Authorization code flow

Connect to Kandio directly from you own application to receive the required access token for accessing Kandio's API resources. Follow the guidelines below to manage the authorization code flow.

The Authorization Code grant type is used by API applications integrating to Kandio's API to exchange an authorization code for an access token. Allow the user to trigger the authorisation flow from your system by implementing the following flow:

  • Your system sends the user and password to Kandio's authentication server.

  • Kandio will repond with an access token and refresh token for your application to use

  • Your system automatically handles the continuous refresh token exchange.

Requirements and limitations

  • The Kandio's OpenApi requires HTTPS.

  • Kandio's OAuth access tokens expire after 1 hour. After expiration, applications must generate a new OAuth access token using the refresh token received when the authorization was first granted.

  • Refresh tokens can only be used once.

Requesting tokens

POST /oauth/token

Request Body

Name
Type
Description

password*

String

password

username*

String

username

client_secret*

String

client_secret

client_id*

String

client_id

password*

String

password

scope*

String

*

Refreshing tokens

POST /oauth/token

Request Body

Name
Type
Description

grant_type*

String

refresh_token

client_id*

String

client_id

client_secret

String

client_secret

refresh_token*

String

refresh_token

scope*

String

*

Last updated