Token
Three grant types.
urn:ietf:params:oauth:grant-type:device_code polls a device
authorization. Until the person approves it answers
authorization_pending; poll faster than interval and it answers
slow_down, which means widen your interval and keep it widened.
authorization_code exchanges a code from /oauth/authorize, with the
code_verifier matching the challenge you sent and the same
redirect_uri. A code works once: presenting it again also revokes
what the first exchange issued.
refresh_token exchanges a refresh token. The presented token is
consumed whatever happens next, so store the new one before using it.
Presenting a consumed refresh token again ends the whole authorization,
since it means the token was copied.
Request Body
application/x-www-form-urlencoded
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
curl -X POST "https://api.vpndetection.io/oauth/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d 'grant_type=string&client_id=string'{
"access_token": "string",
"token_type": "string",
"expires_in": 0,
"refresh_token": "string",
"scope": "string",
"mslm:apikey_id": "string",
"mslm:apikey": "string"
}{
"error": "string",
"error_description": "string"
}{
"error": "string",
"error_description": "string"
}Authorize GET
The browser entry point for the authorization-code flow. This is a redirect target, not something to call from code. Any client may sign in without registering first by using a Client ID Metadata Document: make `client_id` an https URL that serves your client's metadata as JSON, naming that same URL as its `client_id`, with `token_endpoint_auth_method` `none` and your `redirect_uris`. An https redirect URI must be on the same origin as the `client_id`; a loopback one (`http://127.0.0.1`, `http://[::1]`, `http://localhost`) matches on any port. Such a client is granted `apikeys.use` at most. An unknown `client_id` or an unregistered `redirect_uri` is shown to the USER and never redirected, because sending an error to an address we have not verified belongs to you is how an open redirector works. Everything else comes back to your `redirect_uri` with `error`, your `state`, and `iss`.
Revoke POST
RFC 7009. Always answers 200, including for a token that was never valid - an endpoint that distinguished the two would be a way to test whether a stolen string is a live credential. Revoking a REFRESH token ends the whole authorization and takes its access tokens with it. Revoking an access token affects only that token.