Skip to main content
POST
cURL

Body

application/json

The token request (RFC 6749 section 4.1.3 and 6, with a DPoP proof in the DPoP header, RFC 9449). Send it as a form or as JSON.

grant_type
enum<string>
required

authorization_code to sign in, refresh_token to refresh.

Available options:
authorization_code,
refresh_token
Example:

"authorization_code"

code
string

The code the browser handed back. Needed to sign in.

Maximum string length: 128
Example:

"7t3uQmP0oXr5fVw0b1s2y9nqJpZcE4kGhA8dLmTn6Rw"

code_verifier
string

The PKCE verifier whose hash was the code challenge. Needed to sign in.

Required string length: 43 - 128
Example:

"dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"

redirect_uri
string

The redirect address of the sign-in request, character for character. Needed to sign in.

Maximum string length: 2048
Example:

"https://app.stockshift.test/apps/callback/ios"

refresh_token
string

The refresh token of the last response. Needed to refresh.

Maximum string length: 128
Example:

"3Vq9W0b6mYc2n8dKpXr1sUe4tFhJgA7zLoI5xQwEyBk"

os_version
string | null

The operating system version. Used when signing in.

Maximum string length: 40
Example:

"19.0"

app_build
integer | null

The app's build number. Used when signing in.

Required range: 0 <= x <= 2147483647
Example:

311

attestation
object | null

What App Attest or Play Integrity said about this install. Recorded as a signal and never enforced. Used when signing in.

Response

DeviceCredentialResource

AppTokensResource

data
DeviceCredentialResource · object
required