Skip to main content
POST
The Vehicles API v2.0 will be deprecated by Q4 of 2026. We recommend migrating to the latest version as soon as possible to ensure continued support and access to new features.
This is the per-vehicle OAuth token flow used with the v2.0 API; the authorization code exchanged here comes from a Connect session launched with response_type=code. For the v3 API, applications authenticate with application-level M2M tokens (client credentials) and have no authorization code to exchange.

​
Requesting Access Tokens

Headers
​
string
default:"Basic "
required
The HTTP Authorization header using the Basic authentication scheme.To construct the Authorization header value:
  1. Join your client_id and client_secret with a single colon (:).
  2. Base64-encode the resulting string: base64({client_id}:{client_secret})
  3. Prepend Basic (with a trailing space) to the encoded string.
Your final authorization header value should look like this:Basic bXktY2xpZW50LWlkOm15LWNsaWVudC1zZWNyZXQ=
​
string
required
Must be set to application/x-www-form-urlencoded, matching the format of the request body.
​
string
required
A valid HTTP User Agent value. This value is typically included in the HTTP requests by the client that is making the request. You usually don’t have to set this manually.
Body
​
string
required
The authorization code received in the handle response step.
​
string
required
This value must be set to authorization_code
​
string
required
The redirect_uri provided in the redirect to Connect step. This value is checked to match the URI sent when the user was directed to Connect.
If you launch Connect from a single-page or mobile application, redirect_uri must match the URI passed in your Connect URL, not the redirect for your backend.

​
Response

​
string
A string representing an access token used to make requests to the Smartcar API.
​
number
The number of seconds the access token is valid for. This is always set to 7200 (2 hours)
​
string
A string representing a refresh token, which is used to renew access when the current access token expires. The refresh token expires after 60 days.
​
string
Always set to Bearer.