--- updatedAt: 2026-03-25T11:19:03.000Z --- # Authorize or Refresh Token This method authorizes or refreshes the token depending on the body of the request. For creating new token required parameters are: code, grant_type, redirect_uri, code_verifier and client_id For refreshing existing token required parameters are: refresh_token, grant_type, client_id # OpenAPI definition ```json { "openapi": "3.0.1", "info": { "title": "OpenBanking Services - Account Information Service (AIS)", "description": "The Account Information Service (AIS) offers the following services:\n * Transaction reports for a given account or card account including balances if applicable\n * Balances of a given account or card account\n * A list of available accounts or card account\n * Account details of a given account or card account or of the list of all accessible accounts or card account relative to a granted consent \n\nAbbreviations used in the documentation:\n * TPP - Third Party Providers\n * AIS - Account Information Service\n * ASPSP - Account Servicing Payment Service Provider \n * PSU - Payment Service User\n * SCA - Strong Customer Authentication\n", "version": "1.0" }, "servers": [ { "url": "https://test-openbanking.tbcbank.ge/0.8", "description": "Sandbox" }, { "url": "https://openbanking.tbcbank.ge/0.8", "description": "Production" }, { "url": "https://test-api.tbcbank.ge", "description": "Sandbox for .well-known and authorize endpoints" }, { "url": "https://api.tbcbank.ge", "description": "Production for .well-known and authorize endpoints" } ], "paths": { "/openbanking/oauth/token": { "post": { "summary": "Authorize or Refresh Token", "description": "This method authorizes or refreshes the token depending on the body of the request.\nFor creating new token required parameters are: code, grant_type, redirect_uri, code_verifier and client_id\n\nFor refreshing existing token required parameters are: refresh_token, grant_type, client_id\n", "operationId": "aisoauthtoken", "tags": [ "OAuth" ], "requestBody": { "content": { "application/x-www-form-urlencoded": { "schema": { "$ref": "#/components/schemas/OauthTokenRequest" } } } }, "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/OauthTokenResponse" }, "examples": { "Response example on oauth token generation": { "$ref": "#/components/examples/OauthTokenResponse_Token_Example" }, "Response example on refreshing oauth token": { "$ref": "#/components/examples/OauthTokenResponse_RefreshToken_Example" } } } } }, "400": { "description": "BadRequest", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" }, "examples": { "Error example when Invalid Authorization Code": { "$ref": "#/components/examples/400_BadRequest_Example_InvalidAuthorizationCode_Oauth" }, "Error example when Certificate is Missing": { "$ref": "#/components/examples/400_BadRequest_Example_CertificateMissing_Oauth" } } } } }, "500": { "description": "Server Error", "headers": { "X-Request-ID": { "$ref": "#/components/headers/X-Request-ID" } }, "content": { "application/problem+json": { "schema": { "$ref": "#/components/schemas/ApiProblemDetails" }, "example": { "$ref": "#/components/examples/500_InternalError_Example_Oauth" } } } } } } } }, "components": { "headers": { "X-Request-ID": { "description": "ID of the request, unique to the call, as determined by the initiating party.", "required": true, "example": "dca140c0-7db3-4cf3-9415-81b5a141f5f3", "schema": { "type": "string", "format": "uuid" } } }, "schemas": { "OauthTokenRequest": { "type": "object", "description": "Request body for a consents request.", "required": [ "client_id", "grant_type" ], "properties": { "client_id": { "type": "string", "description": "The client identifier issued to the client during the registration process" }, "code": { "type": "string", "description": "The client will send the authorization code it obtained in the redirect" }, "grant_type": { "enum": [ "authorization_code", "refresh_token", "client_credentials" ], "description": "When creating new token grant_type must be 'authorization_code', for refresh token grant_type must be 'refresh_token'.\n\nIn case Decoupled Authorization value must be 'client_credentials'\n" }, "code_verifier": { "type": "string", "description": "code verifier" }, "refresh_token": { "type": "string", "description": "refresh_token parameter used when refreshing the token" }, "redirect_uri": { "type": "string", "description": "The redirect URL that was used in the initial authorization request" } } }, "OauthTokenResponse": { "type": "object", "properties": { "access_token": { "type": "string", "description": "Access tokens are credentials used to access protected resources. An access token is a string representing an authorization issued to the client. The string is usually opaque to the client. Tokens represent specific scopes and durations of access, granted by the resource owner, and enforced by the resource server and authorization server.", "example": "ffODwEVU5sD9RADdEWEYUQNijrcE" }, "token_type": { "type": "string", "description": "The access token type provides the client with the information required to successfully utilize the access token to make a protected resource request (along with type-specific attributes). The client MUST NOT use an access token if it does not understand the token type.", "example": "Bearer" }, "refresh_token": { "type": "string", "description": "Refresh tokens are credentials used to obtain access tokens. Refresh tokens are issued to the client by the authorization server and are used to obtain a new access token when the current access token becomes invalid or expires, or to obtain additional access tokens with identical or narrower scope (access tokens may have a shorter lifetime and fewer permissions than authorized by the resource owner). Issuing a refresh token is optional at the discretion of the authorization server.", "example": "qjfHpGMyOZGv7gZVRxGPGoPfbgHNwIHs" }, "refresh_token_issued_at": { "type": "string", "description": "refresh token issued timestamp", "example": "1682595156807" }, "refresh_token_expires_in": { "type": "string", "description": "The lifetime in seconds of the access token. For example, the value \"3600\" denotes that the access token will expire in one hour from the time the response was generated. If omitted, the authorization server SHOULD provide the expiration time via other means or document the default value", "example": "7775593" }, "refresh_count": { "type": "integer", "description": "indicates how many times the token has been refreshed", "example": 1 }, "scope": { "type": "string", "description": "The authorization and token endpoints allow the client to specify the scope of the access request using the \"scope\" request parameter. In turn, the authorization server uses the \"scope\" response parameter to inform the client of the scope of the access token issued.", "example": "PIS:45f90ecc-3879-4574-de8e-08db40b82e17" }, "issued_at": { "type": "string", "description": "refresh token last update timestamp", "example": "1682595563649" }, "expires_in": { "type": "string", "description": "current token expire seconds", "example": "3599" } } }, "ApiProblemDetails": { "description": "A machine-readable format for specifying errors in HTTP API responses.", "type": "object", "properties": { "type": { "description": "A URI reference [RFC3986] that identifies the problem type.", "type": "string" }, "title": { "description": "A short, human-readable summary of the problem type.", "type": "string" }, "status": { "description": "The HTTP status code ([RFC7231], Section 6) generated by the origin server for this occurrence of the problem.", "type": "integer", "format": "int32" }, "detail": { "description": "A human-readable explanation specific to this occurrence of the problem.", "type": "string" }, "instance": { "description": "A URI reference that identifies the specific occurrence of the problem. It may or may not yield further information if dereferenced.", "type": "string" }, "traceId": { "description": "Message identification for searching errors", "type": "string" }, "code": { "type": "string", "description": "Message codes defined for AIS for appropriate HTTP status code" } } } }, "examples": { "400_BadRequest_Example_InvalidAuthorizationCode_Oauth": { "value": { "error": "invalid_request", "error_uri": "https://developers.tbcbank.ge/docs/error-type-400", "error_description": "Invalid Authorization Code", "systemCode": "System code for problem is psd2_oauth.400.001" } }, "400_BadRequest_Example_CertificateMissing_Oauth": { "value": { "error": "CERTIFICATE_MISSING", "error_uri": "https://developers.tbcbank.ge/docs/error-type-400", "error_description": "Certificate is Missing", "systemCode": "System code for problem is psd2_oauth.400.CERTIFICATE_MISSING" } }, "500_InternalError_Example_Oauth": { "value": { "code": "", "traceId": "00-ada2ec0e2c26c91bf50469bf79fdb14e-7bed7bf0dd005c16-01", "type": "https://developers.tbcbank.ge/docs/error-type-500", "title": "Internal Error", "status": 500, "detail": "Something wrong happened in the application" } }, "OauthTokenResponse_Token_Example": { "description": "Response example on oauth token generation", "value": { "access_token": "ffODwEVU5sD9RADdEWEYUQNijrcE", "token_type": "Bearer", "refresh_token": "qjfHpGMyOZGv7gZVRxGPGoPfbgHNwIHs", "refresh_token_issued_at": "1682595156807", "refresh_token_expires_in": "7775999", "refresh_count": 0, "scope": "PIS:45f90ecc-3879-4574-de8e-08db40b82e17", "issued_at": "1682595156807", "expires_in": 3599 } }, "OauthTokenResponse_RefreshToken_Example": { "description": "Response example on refreshing oauth token", "value": { "access_token": "olFXJEkx4pA8OEFu2IHoLSsh8fFZ", "token_type": "Bearer", "refresh_token": "qjfHpGMyOZGv7gZVRxGPGoPfbgHNwIHs", "refresh_token_issued_at": "1682595156807", "refresh_token_expires_in": "7775593", "refresh_count": 1, "scope": "PIS:45f90ecc-3879-4574-de8e-08db40b82e17", "issued_at": "1682595563649", "expires_in": 3599 } } } }, "security": [ {} ], "x-readme": { "explorer-enabled": true, "proxy-enabled": true } } ```