Skip to main content
POST
Exchange the code for the account key

Query Parameters

locale
enum<string>
default:en

Response language: messages (title, detail) and labels, ro or en. The codes are the same in any language. It takes precedence over Accept-Language and the account language.

Available options:
ro,
en

Body

application/x-www-form-urlencoded
grant_type
enum<string>
required

Always authorization_code.

Available options:
authorization_code
code
string
required

The code received at the redirect address, in ?code=.

redirect_uri
string
required

The exact redirect address from the consent request.

code_verifier
string
required

The PKCE verifier you generated before the consent request (43–128 characters).

Required string length: 43 - 128
client_id
string
required

The public identifier of the integrator (hsrc_…). It can also be sent via HTTP Basic.

client_secret
string
required

The integrator's secret (hsrs_…), only from your server. It can also be sent via HTTP Basic.

Response

The account key, linked to the integrator. Keep it on the server, next to connection_id.

access_token
string
required

The account key, to be sent as Authorization: Bearer.

token_type
enum<string>
required

Always Bearer.

Available options:
Bearer
expires_in
integer
required

In how many seconds the key expires (365 days). Before expiry, the account goes through consent again.

scope
string
required

The granted rights, separated by space.

connection_id
integer
required

The link to this account. It comes in the connection field of every event delivered to the integrator's webhook.