Access Token - OAuth2 API
Use OAuth2 to generate a temporary Bearer token before calling DQE APIs. The flow uses your licence code, client secret, and requested scope to return an access token with a limited validity period.
access_token
Request
Both GET and POST are supported.
{SERVER_ADDRESS} and
{LICENCE_CODE} are provided by DQE upon
account creation. Contact your DQE account manager to obtain
these credentials.
GEThttps://{SERVER_ADDRESS}/oauth/access_token/?client_secret={CLIENT_SECRET}&scope={SCOPE}&client_id={LICENCE_CODE}
Code examples
Request a token for the DQE Address API scope
curl "https://{SERVER_ADDRESS}/oauth/access_token/?client_secret=abcd&scope=client_address&client_id={LICENCE_CODE}"
fetch("https://{SERVER_ADDRESS}/oauth/access_token/?"
+ new URLSearchParams({
client_secret: "abcd",
scope: "client_address",
client_id: "{LICENCE_CODE}"
}))
.then(r => r.json())
.then(data => console.log(data));
import requests
response = requests.get(
"https://{SERVER_ADDRESS}/oauth/access_token/",
params={
"client_secret": "abcd",
"scope": "client_address",
"client_id": "{LICENCE_CODE}",
},
)
print(response.json())
<?php
$params = http_build_query([
'client_secret' => 'abcd',
'scope' => 'client_address',
'client_id' => '{LICENCE_CODE}',
]);
$ch = curl_init("https://{SERVER_ADDRESS}/oauth/access_token/?{$params}");
curl_setopt($ch, CURLOPT_RETURNTRANSFER,
true);
$response = curl_exec($ch);
curl_close($ch);
$data = json_decode($response, true);
const axios = require('axios');
axios.get('https://{SERVER_ADDRESS}/oauth/access_token/',
{
params: {
client_secret: 'abcd',
scope: 'client_address',
client_id: '{LICENCE_CODE}'
}
})
.then(response => console.log(response.data));
HttpClient client = HttpClient.newHttpClient();
String url = "https://{SERVER_ADDRESS}/oauth/access_token/"
+ "?client_secret=abcd&scope=client_address&client_id={LICENCE_CODE}";
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create(url))
.GET()
.build();
HttpResponse<String> response = client.send(request,
HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());
using var client = new HttpClient();
var url = "https://{SERVER_ADDRESS}/oauth/access_token/"
+
"?client_secret=abcd&scope=client_address&client_id={LICENCE_CODE}";
var response = await client.GetAsync(url);
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine(body);
package main
import (
"fmt"
"io"
"net/http"
)
func main() {
url := "https://{SERVER_ADDRESS}/oauth/access_token/"
+
"?client_secret=abcd&scope=client_address&client_id={LICENCE_CODE}"
resp, err := http.Get(url)
if err != nil {
panic(err)
}
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(string(body))
}
POSThttps://{SERVER_ADDRESS}/oauth/access_token/
Send all parameters in the request body using
Content-Type: application/x-www-form-urlencoded.
The server address remains in the URL.
Code examples
Request a token for the DQE Address API scope
curl -X POST "https://{SERVER_ADDRESS}/oauth/access_token/"
\
-H "Content-Type: application/x-www-form-urlencoded"
\
-d "client_id={LICENCE_CODE}" \
-d "client_secret=abcd" \
-d "scope=client_address"
fetch("https://{SERVER_ADDRESS}/oauth/access_token/",
{
method: "POST",
headers: { "Content-Type": "application/x-www-form-urlencoded"
},
body: new URLSearchParams({
client_id: "{LICENCE_CODE}",
client_secret: "abcd",
scope: "client_address"
})
})
.then(r => r.json())
.then(data => console.log(data));
import requests
response = requests.post(
"https://{SERVER_ADDRESS}/oauth/access_token/",
data={
"client_id": "{LICENCE_CODE}",
"client_secret": "abcd",
"scope": "client_address",
},
)
print(response.json())
<?php
$ch = curl_init("https://{SERVER_ADDRESS}/oauth/access_token/");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'client_id' => '{LICENCE_CODE}',
'client_secret' => 'abcd',
'scope' => 'client_address',
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER,
true);
$response = curl_exec($ch);
curl_close($ch);
$data = json_decode($response, true);
const axios = require('axios');
const qs = require('querystring');
axios.post('https://{SERVER_ADDRESS}/oauth/access_token/',
qs.stringify({
client_id: '{LICENCE_CODE}',
client_secret: 'abcd',
scope: 'client_address'
}))
.then(response => console.log(response.data));
HttpClient client = HttpClient.newHttpClient();
String form = "client_id={LICENCE_CODE}&client_secret=abcd&scope=client_address";
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://{SERVER_ADDRESS}/oauth/access_token/"))
.header("Content-Type", "application/x-www-form-urlencoded")
.POST(HttpRequest.BodyPublishers.ofString(form))
.build();
HttpResponse<String> response = client.send(request,
HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());
using var client = new HttpClient();
var form = new Dictionary<string, string>
{
["client_id"] = "{LICENCE_CODE}",
["client_secret"] = "abcd",
["scope"] = "client_address"
};
var response = await client.PostAsync(
"https://{SERVER_ADDRESS}/oauth/access_token/",
new FormUrlEncodedContent(form));
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine(body);
package main
import (
"fmt"
"io"
"net/http"
"net/url"
)
func main() {
form := url.Values{}
form.Set("client_id", "{LICENCE_CODE}")
form.Set("client_secret", "abcd")
form.Set("scope", "client_address")
resp, err := http.PostForm("https://{SERVER_ADDRESS}/oauth/access_token/",
form)
if err != nil {
panic(err)
}
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(string(body))
}
Parameters
| Parameter | Description | Mand / Opt |
|---|---|---|
| client_id | Number assigned to you as your licence code. | Mandatory |
| client_secret | Passphrase provided by DQE Software. | Mandatory |
| scope |
Defines the requested authorization scope. Available values include:
|
Mandatory |
Response
If authentication succeeds, the API returns a JSON dictionary containing the following keys.
| Key | Description | Type |
|---|---|---|
| access_token | Temporary token used to call the service. | String |
| token_type |
Bearer — authorized token type.
|
String |
| expires_in | Token validity period, in seconds. | String |
| refresh_token | Token used to extend your session. | String |
Response example
Example token response
{
"access_token":
"TK948869a6f873adb622enhoaGeVY2iRaptqlmpplGeWZA",
"token_type":
"Bearer",
"expires_in":
"300",
"refresh_token":
"*TK9bdd05f8e9d3c905834bdeqaUlGFll2iRaplll29mZmtkZQ"
}
Errors
| Error type | Example request | Response |
|---|---|---|
Missing client_id parameter
|
https://{SERVER_ADDRESS}/oauth/access_token/?client_secret=abcd&scope=client_address
|
400 Invalid Request |
Empty client_id parameter
|
https://{SERVER_ADDRESS}/oauth/access_token/?client_secret=abcd&scope=client_address&client_id=
|
400 Invalid Request |
Incorrect client_id (expired, out
of scope, or nonexistent)
|
https://{SERVER_ADDRESS}/oauth/access_token/?client_secret=abcd&scope=client_address&client_id={INCORRECT_LICENCE_CODE}
|
400 Invalid Client |
client_id does not authorize the
requested scope
|
https://{SERVER_ADDRESS}/oauth/access_token/?client_secret=abcd&scope=client_address&client_id={LICENCE_CODE_NOT_AUTHORIZED}
|
400 Unauthorized Client |
Unknown scope parameter value
|
https://{SERVER_ADDRESS}/oauth/access_token/?client_secret=abcd&scope=client&client_id={LICENCE_CODE}
|
400 Unsupported Grant Type |
Missing or empty client_secret parameter
|
https://{SERVER_ADDRESS}/oauth/access_token/?scope=client_address&client_id={LICENCE_CODE}https://{SERVER_ADDRESS}/oauth/access_token/?client_secret=&scope=client_address&client_id={LICENCE_CODE}
|
400 Invalid Request |
Missing or empty scope parameter
|
https://{SERVER_ADDRESS}/oauth/access_token/?client_secret=abcd&client_id={LICENCE_CODE}https://{SERVER_ADDRESS}/oauth/access_token/?client_secret=abcd&scope=&client_id={LICENCE_CODE}
|
400 Invalid Request |
| Parameter typo |
https://{SERVER_ADDRESS}/oauth/access_token/?client_scret=abcd&scope=client_address&client_id={LICENCE_CODE}
|
500 Internal Server Error |
Test the API
Click the button below to test this endpoint live in your browser.
Open console
Refresh Token - OAuth2 API
Use this endpoint to get a new access token without repeating
the full authentication flow. Pass the access_token
and refresh_token you received previously —
no licence code or client secret required.
refresh_token
Request
Both GET and POST are supported.
No licence code or client secret needed here.
Refreshing rotates both tokens: the response returns a brand-new
access_token AND a brand-new refresh_token
— the previous pair stops working immediately, so store the
new values.
GEThttps://{SERVER_ADDRESS}/oauth/access_token/?scope=refresh_token&access_token={ACCESS_TOKEN}&refresh_token={REFRESH_TOKEN}
Code examples
Refresh a previously issued token
curl "https://{SERVER_ADDRESS}/oauth/access_token/?scope=refresh_token&access_token={ACCESS_TOKEN}&refresh_token={REFRESH_TOKEN}"
fetch("https://{SERVER_ADDRESS}/oauth/access_token/?"
+ new URLSearchParams({
scope: "refresh_token",
access_token: "{ACCESS_TOKEN}",
refresh_token: "{REFRESH_TOKEN}"
}))
.then(r => r.json())
.then(data => console.log(data));
import requests
response = requests.get(
"https://{SERVER_ADDRESS}/oauth/access_token/",
params={
"scope": "refresh_token",
"access_token": "{ACCESS_TOKEN}",
"refresh_token": "{REFRESH_TOKEN}",
},
)
print(response.json())
<?php
$params = http_build_query([
'scope' => 'refresh_token',
'access_token' => '{ACCESS_TOKEN}',
'refresh_token' => '{REFRESH_TOKEN}',
]);
$ch = curl_init("https://{SERVER_ADDRESS}/oauth/access_token/?{$params}");
curl_setopt($ch, CURLOPT_RETURNTRANSFER,
true);
$response = curl_exec($ch);
curl_close($ch);
$data = json_decode($response, true);
const axios = require('axios');
axios.get('https://{SERVER_ADDRESS}/oauth/access_token/',
{
params: {
scope: 'refresh_token',
access_token: '{ACCESS_TOKEN}',
refresh_token: '{REFRESH_TOKEN}'
}
})
.then(response => console.log(response.data));
HttpClient client = HttpClient.newHttpClient();
String url = "https://{SERVER_ADDRESS}/oauth/access_token/"
+ "?scope=refresh_token&access_token={ACCESS_TOKEN}&refresh_token={REFRESH_TOKEN}";
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create(url))
.GET()
.build();
HttpResponse<String> response = client.send(request,
HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());
using var client = new HttpClient();
var url = "https://{SERVER_ADDRESS}/oauth/access_token/"
+
"?scope=refresh_token&access_token={ACCESS_TOKEN}&refresh_token={REFRESH_TOKEN}";
var response = await client.GetAsync(url);
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine(body);
package main
import (
"fmt"
"io"
"net/http"
)
func main() {
url := "https://{SERVER_ADDRESS}/oauth/access_token/"
+
"?scope=refresh_token&access_token={ACCESS_TOKEN}&refresh_token={REFRESH_TOKEN}"
resp, err := http.Get(url)
if err != nil {
panic(err)
}
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(string(body))
}
POSThttps://{SERVER_ADDRESS}/oauth/access_token/
Send all parameters in the request body using
Content-Type: application/x-www-form-urlencoded.
The server address remains in the URL.
Code examples
Refresh a previously issued token
curl -X POST "https://{SERVER_ADDRESS}/oauth/access_token/"
\
-H "Content-Type: application/x-www-form-urlencoded"
\
-d "scope=refresh_token" \
-d "access_token={ACCESS_TOKEN}" \
-d "refresh_token={REFRESH_TOKEN}"
fetch("https://{SERVER_ADDRESS}/oauth/access_token/",
{
method: "POST",
headers: { "Content-Type": "application/x-www-form-urlencoded"
},
body: new URLSearchParams({
scope: "refresh_token",
access_token: "{ACCESS_TOKEN}",
refresh_token: "{REFRESH_TOKEN}"
})
})
.then(r => r.json())
.then(data => console.log(data));
import requests
response = requests.post(
"https://{SERVER_ADDRESS}/oauth/access_token/",
data={
"scope": "refresh_token",
"access_token": "{ACCESS_TOKEN}",
"refresh_token": "{REFRESH_TOKEN}",
},
)
print(response.json())
<?php
$ch = curl_init("https://{SERVER_ADDRESS}/oauth/access_token/");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'scope' => 'refresh_token',
'access_token' => '{ACCESS_TOKEN}',
'refresh_token' => '{REFRESH_TOKEN}',
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER,
true);
$response = curl_exec($ch);
curl_close($ch);
$data = json_decode($response, true);
const axios = require('axios');
const qs = require('querystring');
axios.post('https://{SERVER_ADDRESS}/oauth/access_token/',
qs.stringify({
scope: 'refresh_token',
access_token: '{ACCESS_TOKEN}',
refresh_token: '{REFRESH_TOKEN}'
}))
.then(response => console.log(response.data));
HttpClient client = HttpClient.newHttpClient();
String form = "scope=refresh_token&access_token={ACCESS_TOKEN}&refresh_token={REFRESH_TOKEN}";
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://{SERVER_ADDRESS}/oauth/access_token/"))
.header("Content-Type", "application/x-www-form-urlencoded")
.POST(HttpRequest.BodyPublishers.ofString(form))
.build();
HttpResponse<String> response = client.send(request,
HttpResponse.BodyHandlers.ofString());
System.out.println(response.body());
using var client = new HttpClient();
var form = new Dictionary<string, string>
{
["scope"] = "refresh_token",
["access_token"] = "{ACCESS_TOKEN}",
["refresh_token"] = "{REFRESH_TOKEN}"
};
var response = await client.PostAsync(
"https://{SERVER_ADDRESS}/oauth/access_token/",
new FormUrlEncodedContent(form));
var body = await response.Content.ReadAsStringAsync();
Console.WriteLine(body);
package main
import (
"fmt"
"io"
"net/http"
"net/url"
)
func main() {
form := url.Values{}
form.Set("scope", "refresh_token")
form.Set("access_token", "{ACCESS_TOKEN}")
form.Set("refresh_token", "{REFRESH_TOKEN}")
resp, err := http.PostForm("https://{SERVER_ADDRESS}/oauth/access_token/",
form)
if err != nil {
panic(err)
}
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(string(body))
}
Parameters
| Parameter | Description | Mand / Opt |
|---|---|---|
| scope |
Must be the literal value refresh_token.
Fixed value: refresh_token
|
Mandatory |
| access_token | The access token previously returned by the Access Token endpoint. | Mandatory |
| refresh_token | The refresh token previously returned by the Access Token endpoint. | Mandatory |
Response
If the refresh succeeds, the API returns the same JSON shape as the Access Token endpoint — with a brand-new token pair.
| Key | Description | Type |
|---|---|---|
| access_token | New temporary token used to call the service. | String |
| token_type |
Bearer — authorized token type.
|
String |
| expires_in | Token validity period, in seconds. | String |
| refresh_token | New refresh token — use this one for the next refresh, the previous one is no longer valid. | String |
Response example
Example refreshed token response
{
"access_token":
"TK948869a6f873adb622enhoaGeVY2iRaptqlmpplGeWZA",
"token_type":
"Bearer",
"expires_in":
"300",
"refresh_token":
"*TK9bdd05f8e9d3c905834bdeqaUlGFll2iRaplll29mZmtkZQ"
}
Errors
| Error type | Example request | Response |
|---|---|---|
Missing, empty or invalid scope,
access_token or refresh_token
parameter
|
https://{SERVER_ADDRESS}/oauth/access_token/?scope=refresh_token&access_token=&refresh_token={REFRESH_TOKEN}
|
400 Invalid Request |
access_token or refresh_token
expired or no longer valid
|
https://{SERVER_ADDRESS}/oauth/access_token/?scope=refresh_token&access_token={EXPIRED_TOKEN}&refresh_token={REFRESH_TOKEN}
|
401 Unauthorized |
| Parameter typo or unexpected server issue |
https://{SERVER_ADDRESS}/oauth/access_token/?scpoe=refresh_token&access_token={ACCESS_TOKEN}&refresh_token={REFRESH_TOKEN}
|
500 Internal Server Error |
Test the API
Click the button below to test this endpoint live in your browser.
Open console
See also
Related to