curl -X POST 'https://api.goatpay.com.br/oauth/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=authorization_code' \
-d 'client_id=gp_oauth_live_...' \
-d 'client_secret=SEU_SECRET' \
-d 'code=CODE_DO_CALLBACK' \
-d 'redirect_uri=https://sua-app.com/oauth/callback' \
-d 'code_verifier=SEU_VERIFIER'
curl -X POST 'https://api.goatpay.com.br/oauth/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=refresh_token' \
-d 'client_id=gp_oauth_live_...' \
-d 'client_secret=SEU_SECRET' \
-d 'refresh_token=gp_ort_...'
curl -X POST 'https://api.goatpay.com.br/oauth/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-u 'gp_oauth_live_...:SEU_SECRET' \
-d 'grant_type=authorization_code' \
-d 'code=CODE_DO_CALLBACK' \
-d 'redirect_uri=https://sua-app.com/oauth/callback' \
-d 'code_verifier=SEU_VERIFIER'
{
"access_token": "gp_oat_live_...",
"token_type": "Bearer",
"expires_in": 900,
"refresh_token": "gp_ort_...",
"scope": "account:read payments:read"
}
{
"error": "invalid_grant",
"error_description": "The authorization code is invalid or expired"
}
Protocolo
Obter token
Troca authorization code ou refresh token por access token.
POST
/
oauth
/
token
curl -X POST 'https://api.goatpay.com.br/oauth/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=authorization_code' \
-d 'client_id=gp_oauth_live_...' \
-d 'client_secret=SEU_SECRET' \
-d 'code=CODE_DO_CALLBACK' \
-d 'redirect_uri=https://sua-app.com/oauth/callback' \
-d 'code_verifier=SEU_VERIFIER'
curl -X POST 'https://api.goatpay.com.br/oauth/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=refresh_token' \
-d 'client_id=gp_oauth_live_...' \
-d 'client_secret=SEU_SECRET' \
-d 'refresh_token=gp_ort_...'
curl -X POST 'https://api.goatpay.com.br/oauth/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-u 'gp_oauth_live_...:SEU_SECRET' \
-d 'grant_type=authorization_code' \
-d 'code=CODE_DO_CALLBACK' \
-d 'redirect_uri=https://sua-app.com/oauth/callback' \
-d 'code_verifier=SEU_VERIFIER'
{
"access_token": "gp_oat_live_...",
"token_type": "Bearer",
"expires_in": 900,
"refresh_token": "gp_ort_...",
"scope": "account:read payments:read"
}
{
"error": "invalid_grant",
"error_description": "The authorization code is invalid or expired"
}
Corpo
application/x-www-form-urlencoded (RFC 6749). Resposta no formato OAuth2 puro — sem envelope { success, message, data }.
curl -X POST 'https://api.goatpay.com.br/oauth/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=authorization_code' \
-d 'client_id=gp_oauth_live_...' \
-d 'client_secret=SEU_SECRET' \
-d 'code=CODE_DO_CALLBACK' \
-d 'redirect_uri=https://sua-app.com/oauth/callback' \
-d 'code_verifier=SEU_VERIFIER'
curl -X POST 'https://api.goatpay.com.br/oauth/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-d 'grant_type=refresh_token' \
-d 'client_id=gp_oauth_live_...' \
-d 'client_secret=SEU_SECRET' \
-d 'refresh_token=gp_ort_...'
curl -X POST 'https://api.goatpay.com.br/oauth/token' \
-H 'Content-Type: application/x-www-form-urlencoded' \
-u 'gp_oauth_live_...:SEU_SECRET' \
-d 'grant_type=authorization_code' \
-d 'code=CODE_DO_CALLBACK' \
-d 'redirect_uri=https://sua-app.com/oauth/callback' \
-d 'code_verifier=SEU_VERIFIER'
{
"access_token": "gp_oat_live_...",
"token_type": "Bearer",
"expires_in": 900,
"refresh_token": "gp_ort_...",
"scope": "account:read payments:read"
}
{
"error": "invalid_grant",
"error_description": "The authorization code is invalid or expired"
}
Corpo (form-urlencoded)
string
required
authorization_code ou refresh_token.string
required
Client ID da aplicação.
string
Obrigatório para clients confidential.
string
Código do callback — com
grant_type=authorization_code.string
Mesma URI usada no authorize.
string
PKCE verifier — com
grant_type=authorization_code.string
Com
grant_type=refresh_token. O refresh anterior é invalidado (rotação).Access tokens expiram em 15 minutos (
expires_in: 900). Renove com refresh antes de expirar.Authorizations
Body
application/x-www-form-urlencoded