Generate Access Token

Production

https://{{subdomain}}.daftra.com

POST

/v2/oauth/token

Issues an OAuth 2.0 access token for the Daftra API. The returned token is bound to the account (tenant) identified by the request subdomain.

The primary flow is the password grant: submit the account owner's email (or a staff member's email) as username together with their password, plus the API application's client_id and client_secret. Both account owners and staff users can authenticate through this endpoint.

On success you receive a long-lived Bearer access token and a refresh_token. Send the access token in the Authorization: Bearer <access_token> header on subsequent API calls.

This endpoint is public and does not itself require authentication. Request bodies may be sent as multipart/form-data or application/x-www-form-urlencoded.

Request

Header Params

Body Params multipart/form-data

Responses

🟢200Success

application/json

Access token issued successfully.

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

Request Example

Shell

JavaScript

Java

Swift

curl --location --globoff 'https://.daftra.com/v2/oauth/token' \
--header 'Accept: application/json' \
--header 'Authorization: Bearer ' \
--form 'grant_type="password"' \
--form 'client_id="1"' \
--form 'client_secret="jCfy6cMh1X6NTxR3OWLuvEFa0si5uZKr05UeoAEs"' \
--form 'username="owner@example.com"' \
--form 'password=""' \
--form 'scope=""' \
--form 'refresh_token=""'

Response Example

200 - Example 1

{
    "token_type": "Bearer",
    "expires_in": 94608000,
    "access_token": "string",
    "refresh_token": "string"
}

How To Authorize

GET Site Info