Authorization code flow
Authorization code flow
Connect to Kandio directly from you own application to receive the required access token for accessing Kandio's API resources. Follow the guidelines below to manage the authorization code flow.
The Authorization Code grant type is used by API applications integrating to Kandio's API to exchange an authorization code for an access token. Allow the user to trigger the authorisation flow from your system by implementing the following flow:
Your system sends the user and password to Kandio's authentication server.
Kandio will repond with an access token and refresh token for your application to use
Your system automatically handles the continuous refresh token exchange.
Requirements and limitations
The Kandio's OpenApi requires HTTPS.
Kandio's OAuth access tokens expire after 1 hour. After expiration, applications must generate a new OAuth access token using the refresh token received when the authorization was first granted.
Refresh tokens can only be used once.
Requesting tokens
POST /oauth/token
Request Body
password*
String
password
username*
String
username
client_secret*
String
client_secret
client_id*
String
client_id
password*
String
password
scope*
String
*
Refreshing tokens
POST /oauth/token
Request Body
grant_type*
String
refresh_token
client_id*
String
client_id
client_secret
String
client_secret
refresh_token*
String
refresh_token
scope*
String
*
Last updated