Register & Issue tokens

post

https://oath.fanscore.com/oauth/token

Issues access/refresh tokens. The behaviour depends on the grant_type field.

grant_type	Description
`register`	Register a new standard account and receive tokens
`register_minor`	Register a junior/minor account (requires guardian email)
`password`	Resource Owner Password Credentials
`refresh_token`	Exchange a refresh token for a new access token
`anonymous`	Issue tokens for an anonymous session
`authorization_code`	Exchange an authorisation code (PKCE supported)
`mfa_otp`	Complete MFA with a TOTP/OTP code
`mfa_oob`	Complete MFA with an out-of-band code
`mfa_recovery_codes`	Complete MFA with a recovery code

When MFA is required, the server responds with HTTP 401 and a body containing mfa_token and an mfa object instead of normal tokens.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Form Data

grant_type

string

enum

required

client_id

string

Required for most grant types

client_secret

string

Required for authorization_code (or use Basic Auth)

username

string

User email or username (password / register grants)

password

string

User password (password / register / register_minor grants)

refresh_token

string

Refresh token (refresh_token grant)

code

string

Authorization code (authorization_code grant) or OTP code (mfa_otp / mfa_recovery_codes)

redirect_uri

string

Required for authorization_code grant

code_verifier

string

PKCE verifier (authorization_code grant)

first_name

string

last_name

string

language

string

Junior account email (register_minor)

guardian_email

string

Guardian email (register_minor)

anonymous

string

Anonymous token to link (register grant)

register_source

string

register_type

string

register_platform

string

authenticator_id

uuid

MFA authenticator ID (mfa_otp)

oob_code

string

Out-of-band code (mfa_oob)

trusted_device

boolean

Mark device as trusted (MFA grants)

device_id

uuid

token_version

string

enum

Allowed:

Responses

Language

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200Token response

400Bad Request

401Unauthorized — or MFA required. When MFA is required the body contains an mfa_token instead of access/refresh tokens.

500Internal Server Error