How access tokens work
Why your server exchanges a secret for a short-lived token, and what happens on each request.
MyTPE uses the OAuth 2.0 client credentials grant, which is designed for one server calling another. No person signs in and no browser is involved.
Why exchange the secret
Your secret is long-lived, so it should travel as rarely as possible. A token travels with every request, but expires within an hour. That limits what a leaked token can do.
When access ends
MyTPE checks the installation on every request, not only when it issues the token. Revoking an integration, or removing a scope, takes effect on tokens that are already issued.
Refreshing
There's no refresh token. When a token expires, request a new one with your client credentials.
Postman collection