Client-credentials token for an app backend
Machine-to-machine token bound to the app owner's pid, carrying the app's clientId. Use `Authorization: Bearer <token>`. `clientSecret` is required when the app has one set.
Machine-to-machine token bound to the app owner's pid, carrying the
app's clientId. Use Authorization: Bearer <token>. clientSecret is
required when the app has one set.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Response Body
application/json
application/json
application/json
curl -X POST "https://example.com/auth/token" \ -H "Content-Type: application/json" \ -d '{ "clientId": "string" }'{ "accessToken": "string", "expiresIn": "string"}Rotate the refresh token POST
Rotates the refresh token and issues a fresh access token. The current `pid_refresh` cookie is **invalidated** and replaced with a new one (rotation), so each refresh token can be used exactly once. - 401 if the refresh token is missing, expired, already rotated, or forged. - Rate limited to 10 requests / minute.
Unlink a login credential DELETE
Removes a credential from the current identity. Fails with `400` when it is the identity's last credential — every identity must keep at least one way to log in.