Issue an access token

Request

OAuth 2.0 token endpoint (RFC 6749). Supports three grants:

authorization_code — exchange a code obtained from the browser GET /oauth/authorize flow (PKCE code_verifier required). Returns an access token and a rotating refresh token.
client_credentials — machine-to-machine token for a marketplace installation. Always requires the explicit location_id; the installation is resolved from the authenticated OAuth client plus that Location. No refresh token is returned.
refresh_token — rotate a refresh token from the Authorization Code flow. The previous refresh token is invalidated; replaying it revokes the token family.

Confidential clients authenticate with HTTP Basic (client_secret_basic); public clients (PKCE-only) send their client_id in the form body. There is no password grant.

Errors from this endpoint use the standard OAuth 2.0 error object ({"error": "...", "error_description": "..."}), not application/problem+json.

Bodyapplication/x-www-form-urlencodedrequired

One of:

Token request (RFC 6749, form-encoded). resource selects REST vs MCP token audience (RFC 8707).

grant_typestringrequired

Value:"authorization_code"

codestringrequired

redirect_uristringrequired

code_verifierstringrequired

client_idstringrequired

scopestring

resourcestring

RFC 8707 resource indicator selecting the REST API or MCP audience.

Enum:"https://api.alteg.io""https://mcp.alteg.io"

curl -i -X POST \
  https://developer.alteg.io/_mock/en/b2b-v3/openapi/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d grant_type=client_credentials \
  -d location_id=90211 \
  -d 'scope=appointments:read appointments:create clients:read'

Responses

Token issued.

Bodyapplication/json

access_tokenstringrequired

Opaque access token — never parse it.

token_typestringrequired

Value:"Bearer"

expires_inintegerrequired

Access token lifetime in seconds (about 900).

refresh_tokenstring

Rotating refresh token; only issued by the Authorization Code flow.

scopestring

Space-separated scopes carried by the token.

Response

{
  "access_token": "altg_at_7f3a1c9e0b2d4f68a1c9e0b2",
  "token_type": "Bearer",
  "expires_in": 900,
  "refresh_token": "altg_rt_5b8e2d4f68a1c9e0b2d4f68a",
  "scope": "appointments:read appointments:create clients:read"
}