Get Access Token v4

post

https://api.yelp.com/oauth2/token/v4

OAuth 2.1 token endpoint. Either:

Exchanges an authorization_code for an access_token, or
Exchanges a refresh_token for an access_token.
When exchanging a refresh_token for an access_token, also invalidates existing refresh_token and generates a new refresh_token.
Access tokens expire after 1 hour. Refresh tokens expire after 90 days by default.
See Refresh Tokens for how this works.

If /token or /token/v3 returns 400 TOKEN_V4_REQUIRED, your client must use this endpoint.

Errors use the OAuth 2.1 format with error and error_description.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Form Data

Access Token Request as per https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3

client_id

string

required

ID assigned by Yelp for the third-party system that will make user-authorized requests to Yelp.

client_secret

string

required

length between 64 and 64

Client secret assigned by Yelp for the third-party system that will make user-authorized requests to Yelp.

grant_type

string

enum

required

Value MUST be set to "authorization_code".

Allowed:

code

string

required

Authorization code that is sent back to the redirect uri after a user authorized the client's oauth client.

redirect_uri

string

REQUIRED, if the "redirect_uri" parameter was included in the authorization request and their values MUST be identical.

code_verifier

string

length between 43 and 128

^[A-Za-z0-9\-._~]+$

PKCE code verifier (RFC 7636). The original random string used to generate the
codechallenge sent in the authorization request. Required when the authorization
request included a code_challenge. Must be between 43 and 128 characters,
using [A-Z] / [a-z] / [0-9] / "-" / "." / "" / "~".

code_challenge_method

string

enum

The method used to derive the code_challenge from the code_verifier.
Only S256 is supported.

Allowed:

Responses

Language

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

application/json

200Access and refresh tokens issued.

400Invalid request, client credentials, authorization code, refresh token, grant type, or scope.

401Client authentication failed after an Authorization header was supplied. Send client_id and client_secret in the form body.

429Request rate limit exceeded.

500Internal server error.