How to setup Authorization Code Grant Type | WordPress OAuth Codex

Authorization Code

Documentation under "General" for WP OAuth Server

Authorization Code

The Authorization Code grant type is a 2 part process. The code token must be requested and then exchanged for an access token.

Part One



  • client_id (required)– The client ID making the request
  • redirect_uri (optional|required) – The URL which to redirect back to. This parameter is required if there is not redirect URI defined in the client settings AND OR if “enforce redirect URI” is set in the plugin settings.
  • response_type (required) – Must be set to “code”
  • scope (optional) – Space delimited scope
  • state (optional) – Client generated CSRF token. This value will be passed back to the client.


  • code (string) – The authorization code.
  • state (mixed) – If a state parameter were supplied in the request, it would be returned.

Part Two

Once you have the authorization code, you must make another request to obtain an access token. The authorization code is only valid for approximately 30 seconds.


Authorization: Bearer {base64 encoded client_id:client_secret}
  • grant_type (required) – Must be “authorization_code”
  • code (required) – The code returned from the authorization server
  • client_id (optional) – The client id
  • client_secret (optional) – The client secret
  • redirect_uri (optional) – URL to redirect the user back to
  • state (optional|required) – CSRF Token. Required if “enforce state” is enabled.

* The parameters “client_id” and “client_secret” should be sent as a basic authorization header when possible.


The response will be in JSON format

  • access_token – The access token
  • expires_in – Time the access token expires in seconds from current time
  • token_type – Type of token. “Bearer” is only supported
  • scope – The scopes authorized for this access token
  • refresh_token – The refresh token
 "access_token": "aph6jiiwsvgyt9j4fohayegypbo65f8fpjodpdckuiqho0p4wf",
 "expires_in": 3600,
 "token_type": "Bearer",
 "scope": "asd",
 "refresh_token": "g1b4cph2kjnwojzofajvqsfzb2oltjthtermizvlnzsaqjl2o9"

Requesting the user information using the newly obtained access token is straight forward.

curl -X GET \ \
  -H 'Bearer: aph6jiiwsvgyt9j4fohayegypbo65f8fpjodpdckuiqho0p4wf' \
  -H 'cache-control: no-cache'

In the event that the server is running CGI, header authorization may fail. If this happens, you can send the access token to the “me” endpoint as a GET variable. If you send the access token via the URL instead of a Bearer Token be sure to use HTTPS.

Search Documentation

General Articles

Below is a list of "General" documentation articles.

OAuth Server 3.8.2

WP OAuth Server Pro allows for Unlimited clients and multiple grant types.