Sign in with a custom token
Exchanges a custom token for an ID token and a refresh token. Any client can call it
without a Cowdi access token. The custom token comes from a token exchange operation.
Returns 400 with INVALID_TOKEN when the custom token is invalid or Firebase rejects
it. Returns 503 with SERVICE_TEMPORARILY_UNAVAILABLE when Firebase is not available.
Send the same request again later. Use the ID token as the Bearer token for API calls,
and refresh it through /v1/auth/refresh before it expires.
Request Body
application/json
Request to sign in with a custom token
Response Body
application/json
application/json
application/json
curl -X POST "https://example.com/v1/auth/sign-in" \ -H "Content-Type: application/json" \ -d '{ "custom_token": "custom_token_abc123def456ghi789" }'Successful Sign In
{ "id_token": "<signed JWT>", "refresh_token": "AOEOulb...", "expires_in": 3600}{ "code": "BAD_REQUEST", "description": "Invalid input"}{ "code": "BAD_REQUEST", "description": "Invalid input"}Refresh an ID token POST
Exchanges a refresh token for a new ID token and a new refresh token. Any client can call it without a Cowdi access token. The refresh token must come from the sign in operation or an earlier refresh call. Returns 400 with `INVALID_TOKEN` when the refresh token is invalid or expired. Returns 503 with `SERVICE_TEMPORARILY_UNAVAILABLE` when Firebase is not available. Keep the refresh token and send the request again later. Use the new ID token as the Bearer token for further API calls.
List OAuth clients GET
Lists every OAuth client of the caller's organization, on one page. Requires the `org:connect:read` permission. Secrets are not carried here; list them separately through the list client secrets operation.