Skip to Content
API ReferenceAuthenticationThird-Party App AuthenticationGenerate Access Token
Open in GPTGPTOpen in ClaudeClaude

Generate Access Token

This API allows you to exchange an auth code for the access token of a user.

USE CASE

Get a user's access_token from your backend as soon as the redirect returns an auth_code. Keep the app_secret on your server.

Details

  • POST the auth_code and appIdHash (SHA-256 of api_id + app_secret) to the Validate Authcode API endpoint to obtain the access_token.
  • Send a POST request with a JSON body containing grant_type (authorization_code), appIdHash and code, the auth_code from the redirect.
  • appIdHash is the SHA-256 hash of app_id:app_secret; keep the app_secret on your server and never share it.
  • Send app_id:access_token in the HTTP Authorization header on every later request made for this user.
  • If a token is expired or invalid, API calls return error code -8, -15, -16 or -17. See API Error Codes.

Request Attributes

AttributeData TypeDescription
grant_typestringThis value must always be “authorization_code”
appIdHashstring
  • SHA-256 of api_id + app_secret
  • Eg: SHA-256 of app_id:app_secret is
  • 7c7120d2b5004f8de22d8dc2da0453b4d7e6211e37a4108b8371266ecff00498
  • You can use this online tool for reference
codestringThis is the auth_code which is received from the first step

Response Attributes

AttributeData TypeDescription
sstringok / error
codeintThis is the code to identify specific responses
messagestringThis is the message to identify the specific error responses
access_tokenstringThis value will be used for all the subsequent requests.

Note: FYERS API access tokens expire daily at 6:30 AM. Generate a new token after 6:30 AM for it to remain valid throughout the day.

Last updated on
Authorization CodeBest Practices