Token endpoint (RFC 6749 §5 / OAuth 2.1)
OAuth
Token endpoint (RFC 6749 §5 / OAuth 2.1)
Token endpoint (RFC 6749 §5 / OAuth 2.1). authorization_code grant exchanges a PKCE-verified, single-use code for an access+refresh pair; refresh_token grant rotates a refresh token (single-use, whole rotation family revoked on reuse). Public clients only — never a client_secret.
POST
Token endpoint (RFC 6749 §5 / OAuth 2.1)
Authorizations
Issue keys in Settings → API. Send them as Authorization: Bearer ont_… (an X-Api-Key: ont_… header is also accepted). Session-cookie routes are used by the OnTime web apps and are shown for completeness.