curl --request POST \
--url https://staging.housera.ro/api/v1/oauth/token \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data grant_type=authorization_code \
--data 'code=<string>' \
--data 'redirect_uri=<string>' \
--data 'code_verifier=<string>' \
--data 'client_id=<string>' \
--data 'client_secret=<string>'<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://staging.housera.ro/api/v1/oauth/token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "grant_type=authorization_code&code=%3Cstring%3E&redirect_uri=%3Cstring%3E&code_verifier=%3Cstring%3E&client_id=%3Cstring%3E&client_secret=%3Cstring%3E",
CURLOPT_HTTPHEADER => [
"Content-Type: application/x-www-form-urlencoded"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}const options = {
method: 'POST',
headers: {'Content-Type': 'application/x-www-form-urlencoded'},
body: new URLSearchParams({
grant_type: 'authorization_code',
code: '<string>',
redirect_uri: '<string>',
code_verifier: '<string>',
client_id: '<string>',
client_secret: '<string>'
})
};
fetch('https://staging.housera.ro/api/v1/oauth/token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://staging.housera.ro/api/v1/oauth/token"
payload = {
"grant_type": "authorization_code",
"code": "<string>",
"redirect_uri": "<string>",
"code_verifier": "<string>",
"client_id": "<string>",
"client_secret": "<string>"
}
headers = {"Content-Type": "application/x-www-form-urlencoded"}
response = requests.post(url, data=payload, headers=headers)
print(response.text){
"access_token": "<string>",
"token_type": "Bearer",
"expires_in": 123,
"scope": "<string>",
"connection_id": 123
}{
"error": "invalid_client",
"error_description": "<string>"
}{
"error": "invalid_client",
"error_description": "<string>"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>"
}Exchange the code for the account key
The server-to-server step in “Connect with Housera”: the integrator, authenticated with its secret, exchanges the one-time code received at the redirect address (and the code_verifier PKCE) for the account key that has been accepted. The code expires in 60 seconds and can only be used once; a code used a second time revokes the key it granted. The complete guide is on the Connect with Housera page.
curl --request POST \
--url https://staging.housera.ro/api/v1/oauth/token \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data grant_type=authorization_code \
--data 'code=<string>' \
--data 'redirect_uri=<string>' \
--data 'code_verifier=<string>' \
--data 'client_id=<string>' \
--data 'client_secret=<string>'<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://staging.housera.ro/api/v1/oauth/token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "grant_type=authorization_code&code=%3Cstring%3E&redirect_uri=%3Cstring%3E&code_verifier=%3Cstring%3E&client_id=%3Cstring%3E&client_secret=%3Cstring%3E",
CURLOPT_HTTPHEADER => [
"Content-Type: application/x-www-form-urlencoded"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}const options = {
method: 'POST',
headers: {'Content-Type': 'application/x-www-form-urlencoded'},
body: new URLSearchParams({
grant_type: 'authorization_code',
code: '<string>',
redirect_uri: '<string>',
code_verifier: '<string>',
client_id: '<string>',
client_secret: '<string>'
})
};
fetch('https://staging.housera.ro/api/v1/oauth/token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://staging.housera.ro/api/v1/oauth/token"
payload = {
"grant_type": "authorization_code",
"code": "<string>",
"redirect_uri": "<string>",
"code_verifier": "<string>",
"client_id": "<string>",
"client_secret": "<string>"
}
headers = {"Content-Type": "application/x-www-form-urlencoded"}
response = requests.post(url, data=payload, headers=headers)
print(response.text){
"access_token": "<string>",
"token_type": "Bearer",
"expires_in": 123,
"scope": "<string>",
"connection_id": 123
}{
"error": "invalid_client",
"error_description": "<string>"
}{
"error": "invalid_client",
"error_description": "<string>"
}{
"type": "<string>",
"title": "<string>",
"status": 123,
"code": "<string>",
"detail": "<string>"
}Query Parameters
Response language: messages (title, detail) and labels, ro or en. The codes are the same in any language. It takes precedence over Accept-Language and the account language.
ro, en Body
Always authorization_code.
authorization_code The code received at the redirect address, in ?code=.
The exact redirect address from the consent request.
The PKCE verifier you generated before the consent request (43–128 characters).
43 - 128The public identifier of the integrator (hsrc_…). It can also be sent via HTTP Basic.
The integrator's secret (hsrs_…), only from your server. It can also be sent via HTTP Basic.
Response
The account key, linked to the integrator. Keep it on the server, next to connection_id.
The account key, to be sent as Authorization: Bearer.
Always Bearer.
Bearer In how many seconds the key expires (365 days). Before expiry, the account goes through consent again.
The granted rights, separated by space.
The link to this account. It comes in the connection field of every event delivered to the integrator's webhook.