Livepush Developers

Authentication

Exchange a code or refresh token

GET https://tokens.livepush.io/oauth2/access_token

Base URL https://tokens.livepush.io — Authentication & OAuth 2.0

Exchanges an authorization code for an access and refresh token pair, or rotates an existing refresh token. Access tokens are valid for 14 days.

Refresh tokens are single use — the supplied one is disabled as soon as a new pair is issued, so store the new refresh_token from every response.

Call this server-side only. It is a GET and takes client_secret as a query parameter, so the secret lands in proxy logs, browser history and access logs if it is ever called from a client. Make sure your own logging redacts it.

Authorization

This endpoint does not require authentication.

Try it

GET https://tokens.livepush.io/oauth2/access_token — This call only reads data.

Parameters

Query parameters

  • grant_type string required
    Use authorization_code for a fresh grant, or refresh_token to rotate an existing one.
    authorization_coderefresh_token
    example: authorization_code
  • code string required
    The grant code, or — when grant_type is refresh_token — the refresh token. Both are passed in this same parameter.
  • client_id string required
    Client ID issued by the developer console.
  • client_secret string required
    Client secret. Server-side only.
  • redirect_uri string required
    Must match the value the code was issued against.
    example: https://yourapp.example.com/callback

Code samples

request.sh 
curl -X GET 'https://tokens.livepush.io/oauth2/access_token?grant_type=authorization_code&code=%3Ccode%3E&client_id=%3Cclient_id%3E&client_secret=%3Cclient_secret%3E&redirect_uri=https%3A%2F%2Fyourapp.example.com%2Fcallback'
const response = await fetch('https://tokens.livepush.io/oauth2/access_token?grant_type=authorization_code&code=%3Ccode%3E&client_id=%3Cclient_id%3E&client_secret=%3Cclient_secret%3E&redirect_uri=https%3A%2F%2Fyourapp.example.com%2Fcallback', {
  method: 'GET',
});

if (!response.ok) {
  throw new Error(`Livepush API error ${response.status}`);
}

const data = await response.json();
import requests

response = requests.get('https://tokens.livepush.io/oauth2/access_token?grant_type=authorization_code&code=%3Ccode%3E&client_id=%3Cclient_id%3E&client_secret=%3Cclient_secret%3E&redirect_uri=https%3A%2F%2Fyourapp.example.com%2Fcallback', timeout=30)
response.raise_for_status()
data = response.json()

Responses

A new token pair.

application/json

  • access_token string
    JWT to send as Authorization: Bearer <access_token>.
  • refresh_token string
    Opaque token for obtaining the next pair.
  • token_type string
    Always the literal access_token. Non-standard — send the header as Authorization: Bearer … regardless of this value.
  • expires_in integer
    Access token lifetime in seconds. 14 days.
Example 200 response response.json 
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…",
  "refresh_token": "V1StGXR8_Z5jdHi6B-myT…",
  "token_type": "access_token",
  "expires_in": 1209600
}

The exchange failed.

application/json

  • error string
    invalid_requestinvalid_clientinvalid_grantexpired_grantunsupported_response_typeunsupported_grant_typeinvalid_scopeaccess_deniedserver_error
  • error_description string
Example 400 response response.json 
{
  "error": "invalid_client",
  "error_description": "could not identify provided \"client_id\""
}