Create an OAuth token

Request

Exchange credentials or authorisation grants for an OAuth 2.0 access token.

The grant_type field determines which parameters are required and which response fields are returned.

See managing token expiration for guidance on refreshing tokens before they expire.

Security

BasicAuth

X-External-Correlation-Idstring, (uuid), <= 36 characters

Optional UUID for correlating requests across systems. If provided, Wise echoes it back in the response. Maximum 36 characters. Learn more.

Example:f47ac10b-58cc-4372-a567-0e02b2c3d479

Bodyapplication/x-www-form-urlencodedrequired

grant_typestringrequired

OAuth 2.0 grant type.

Value:"client_credentials"

Example:"client_credentials"

Discriminator

curl -i -X POST \
  -u '<client_id>:<client_secret>' \
  https://api.wise.com/oauth/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -H 'X-External-Correlation-Id: f47ac10b-58cc-4372-a567-0e02b2c3d479' \
  -d grant_type=client_credentials

Responses

Token created successfully.

Headers

X-External-Correlation-Idstring, (uuid), <= 36 characters

Echoed back when X-External-Correlation-Id was included in the request. Learn more.

Example:"f47ac10b-58cc-4372-a567-0e02b2c3d479"

x-trace-idstring

Unique trace identifier assigned by Wise. Useful when contacting support about a specific request.

Example:"fba501b6d453b96789f52338f019341f"

Bodyapplication/json

access_tokenstring

Access token to be used when calling the API. Valid for 12 hours.

Example:"01234567-89ab-cdef-0123-456789abcdef"

token_typestring

Type of the token.

Example:"bearer"

refresh_tokenstring

Refresh token used to obtain new user access tokens without requiring the user to re-authorise. Valid for up to 20 years.

Only returned for user access token grant types (registration_code, authorization_code, refresh_token).

Example:"01234567-89ab-cdef-0123-456789abcdef"

expires_ininteger, (int32)

Access token expiry time in seconds.

Example:43199

expires_atstring

Access token expiration timestamp (UTC).

Example:"2025-04-11T03:43:28.148Z"

refresh_token_expires_ininteger, (int32)

Refresh token expiry time in seconds.

Only returned for user access token grant types (registration_code, authorization_code, refresh_token).

Example:628639555

refresh_token_expires_atstring

Refresh token expiration timestamp (UTC).

Only returned for user access token grant types (registration_code, authorization_code, refresh_token).

Example:"2045-03-12T13:49:23.552Z"

scopestring

Scope of the token.

Example:"transfers"

created_atstring

Token creation time in ISO 8601 format.

Only returned for user access token grant types (registration_code, authorization_code, refresh_token).

Example:"2020-01-01T12:33:33.12345Z"

Response

{
  "access_token": "01234567-89ab-cdef-0123-456789abcdef",
  "token_type": "bearer",
  "refresh_token": "01234567-89ab-cdef-0123-456789abcdef",
  "expires_in": 43199,
  "expires_at": "2025-04-11T03:43:28.148Z",
  "refresh_token_expires_in": 628639555,
  "refresh_token_expires_at": "2045-03-12T13:49:23.552Z",
  "scope": "transfers",
  "created_at": "2020-01-01T12:33:33.12345Z"
}