Access tokens
POST /oauth/token issues tokens and POST /oauth/revoke revokes them.Request
Response
Choose a grant
Client credentials
client_credentials gives your application its own token. It carries no connection, so it cannot read or write connection data.connection_id claim (sub stays your client id), and the token response includes connection_id too.Send the request
Content-Type: application/x-www-form-urlencoded. POST /oauth/token also accepts a JSON object with the same parameters as string values under Content-Type: application/json. Any other content type is a 400.client_id and client_secret body fields, never both.Get a connection token
Send your customer through Makini Link
Your customer connects their system in Makini Link. When they finish, Link sends them back to your
redirect_uri with a code. See Launching Makini Link.Exchange the code
On your server, call Don't send a
POST /oauth/token with the authorization_code grant and the code, as in the example above. redirect_uri is optional; if you send it, it must match the one used during authorization exactly, byte for byte.scope parameter. Makini scopes a connection token during the exchange and again on every refresh, so neither the authorization_code nor the refresh_token grant accepts one.Store the connection and the refresh token
Keep
connection_id and refresh_token with your customer's account. The access token is valid for 3,600 seconds (expires_in in the response).Refresh before the token expires
Exchange the refresh token for a new pair, and store the new refresh token in place of the old one:
Keep tokens fresh
Never retry a refresh with an old value
| Token | Lifetime |
|---|---|
| Access token | 3,600 seconds (expires_in in the response). |
| Refresh token | 30 days from its last use. |
client_credentials response never includes a refresh token. On rare occasions a code exchange answers without one too, so treat refresh_token as optional and keep using the access token until it expires.Revoke access
POST /oauth/revoke with a refresh token revokes its whole family and immediately stops every access token issued from it. Pass the refresh token, not an access token: access tokens are self-contained and not stored, so revoking the refresh token is what stops them.token_type_hint is accepted and ignored.200 whether or not the token existed, so it cannot be used to test whether a token is valid. The exceptions are a missing token parameter (400) and a temporary outage (503).Reference
Next steps
Modified at 2026-10-16 14:20:56