POST https://api.mollie.com/oauth2/tokens

This endpoint can only be accessed using OAuth client credentials.

Exchange the authorization code you received from Authentication for an 'access token' API credential, with which you can communicate with the Mollie API on behalf of the consenting merchant.

Headers

Authorization string

The OAuth client ID and client secret as basic access credentials.

Pseudo code:

"Basic " + toBase64(client_id + ":" + client_secret)

For example:

Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

Hints:

• The client credentials can be included either in this Authorization header or in the body parameters.
• This header will be required if you do not send the client_id and client_secret in the body parameters.

Body parameters

grant_type string (required)

If you wish to exchange your authorization code for an app access token, use grant type authorization_code. If you wish to renew your app access token with your refresh token, use grant type refresh_token.

Possible values: authorization_code refresh_token

code string | null

The authorization code you received when creating the authorization. Only use this field when using grant type authorization_code.

refresh_token string | null

The refresh token you received when creating the authorization. Only use this field when using grant type refresh_token.

redirect_uri string | null

The URL the merchant is sent back to once the request has been authorized. It must match the URL you set when registering your app.

For consecutive refresh token requests, this parameter is required only if the initial authorization code grant request also contained a redirect_uri.

client_id string | null

The client ID you received when you registered your OAuth app. The ID starts with app_. For example: app_j9Pakf56Ajta6Y65AkdTtAv. There is no need to send it if you include the client credentials in the Authorization header.

client_secret string | null

The client secret you received when you registered your OAuth app. There is no need to send it if you include the client credentials in the Authorization header.

Response [200]

200 OK

access_token string

The app access token, with which you will be able to access the Mollie API on the merchant's behalf.

refresh_token string

The refresh token, with which you will be able to retrieve new app access tokens on this endpoint. The refresh token does not expire.

expires_in integer

The number of seconds left before the app access token expires. Be sure to renew your app access token before this reaches zero.

token_type string

As per OAuth standards, the provided app access token can only be used with bearer authentication.

Possible values: bearer

scope string

A space-separated list of permissions.

Example response

{
  "access_token": "access_46EUJ6x8jFJZZeAvhNH4JVey6qVpqR",
  "refresh_token": "refresh_FS4xc3Mgci2xQ5s5DzaLXh3HhaTZOP",
  "expires_in": 3600,
  "token_type": "bearer",
  "scope": "payments.read organizations.read"
}

Response [400]

400 Bad Request

error string

The error code. For example: invalid_grant.

error_description string

The error description in details. For example: Authorization code doesn't exist or is invalid for the client.

Example response

{
  "error": "invalid_grant",
  "error_description": "Authorization code doesn't exist or is invalid for the client"
}