Skip to main content
POST
Get an access token

Authorizations

Authorization
string
header
required

The app's client id (app_…) as the user name and a live client secret (tsy_cs_…) as the password.

Body

Form-encoded (application/x-www-form-urlencoded, parsed flat) or a flat JSON object; at most 8 KB. Every value is one string; a repeated parameter is refused. Unknown parameters and scope are ignored. Never send client_secret in the body (invalid_client).

grant_type
string
required
Allowed value: "urn:ietf:params:oauth:grant-type:token-exchange"
subject_token
string
required

The 60-second ID token the dashboard handed the page. Single use.

Required string length: 1 - 4096
subject_token_type
string
required
Allowed value: "urn:ietf:params:oauth:token-type:id_token"
requested_token_type
enum<string>
default:urn:tassyir:params:oauth:token-type:offline-access-token
Available options:
urn:tassyir:params:oauth:token-type:offline-access-token,
urn:tassyir:params:oauth:token-type:online-access-token
client_id
string

Optional; must equal the client id of the Basic credentials.

Required string length: 1 - 4096

Response

The tokens.

access_token
string
required

Send as Authorization: Bearer <access_token>.

Pattern: ^tsy_at_[0-9A-Za-z]{43}$
token_type
string
required
Allowed value: "Bearer"
expires_in
integer
required

Seconds the access token lives (3600).

scope
string
required

The installation's granted scopes, space-separated.

installation_id
string
required
business_id
string
required
refresh_token
string

Offline tokens only. Rotated on every use; the one used is spent.

Pattern: ^tsy_rt_[0-9A-Za-z]{43}$
refresh_token_expires_in
integer

Seconds the refresh token lives (90 days).

issued_token_type
enum<string>

Token exchanges only (RFC 8693).

Available options:
urn:tassyir:params:oauth:token-type:offline-access-token,
urn:tassyir:params:oauth:token-type:online-access-token
user_id
string

Online tokens only: the user the token acts for.