Issue an access token

post /oauth/token

Exchanges a credential for a bearer token. With client_credentials, a credential is the company’s or a user’s. A user credential issues tokens only once an administrator approves it, and only while its owner is an active member of the company. A scope the credential does not hold is refused with invalid_scope. For a user credential, the token then drops the scopes its owner cannot use in Salesbud at issuance time. Connectors use authorization_code, with the code from /oauth/authorize and its PKCE verifier, and then refresh_token; both answer with a refresh token that is valid once and replaced on every refresh. Reusing a code or a refresh token revokes what was issued from it and answers invalid_grant. A connection still awaiting administrator approval receives tokens, and reads answer 403 API_CLIENT_PENDING_APPROVAL until it is approved. A connection an administrator disabled answers invalid_grant with the error_description “The connection was disabled by a company administrator.” and renews again once it is enabled.

Authorization

No authentication.

Example request

curl -X POST https://api.salesbud.com.br/oauth/token \
  -d 'grant_type=client_credentials' \
  -d 'client_id=sb_client_...' \
  -d 'client_secret=sb_secret_...'

Example response

{
  "access_token": "eyJhbGciOiJSUzI1NiJ9.EXAMPLE_PAYLOAD.EXAMPLE_SIGNATURE",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "meetings.read calls.read transcriptions.read"
}

Responses

Status	Description
`200`	Access token issued.
`400`	OAuth token request rejected.
`401`	OAuth client authentication failed, or the client_id of an authorization_code or refresh_token request is not an accepted connector app. A credential that is pending approval, disabled, revoked or expired fails the same way, and so does a user credential whose owner is no longer an active member of the company, with error_description “The credential has no active owner.”
`403`	API access is disabled for the company, or, for a connection of one of Salesbud‘s own apps, AI collaborators are. This error uses the API error envelope, not the OAuth error format.
`413`	The request body is larger than the accepted limit.
`415`	The request media type is not supported by this endpoint.
`429`	Client rate limit exceeded.
`503`	A required audit or rate-limit dependency is unavailable.