Mint a short-lived access token.

POST 
/access_token

Creates a pair of access credentials — a token and a secret — that a client may use in place of the consumer credentials, and that expires on its own.

The request must be authenticated with consumer credentials. An existing access token cannot mint another one; presenting an access token here fails with forbidden (code 6) Consumer credentials required to create access credentials.

The lifetime is controlled by ttl_seconds in the request body; see CreateAccessTokenRequest for its default and clamping behaviour. The expiry is not echoed back — the response carries only token and secret, so record the lifetime you asked for if you need to know when the token dies.

Request

Responses

200

The new access credentials. Only token and secret are returned.

401

Credentials were missing or invalid. The response carries WWW-Authenticate: Basic realm="Feed.fm".

Response Headers

WWW-Authenticate
The authentication challenge. Always Basic realm="Feed.fm".
Example: Basic realm="Feed.fm"

403

forbidden (code 6) — Consumer credentials required to create access credentials: the request was authenticated with an access token rather than the consumer credentials.

Note that DELETE /access_token/{access_token} reports this same condition differently, as a 404 missingObject. The two routes are deliberately not symmetric here.

429

The server judged the rate of requests from these credentials to be excessive and is refusing them for a time. The block lasts 30 seconds from the request that tripped it. Requests made during the block are refused and do not extend it.

The threshold is not published, and is not part of this contract. The threshold is also tuned from time to time.

The response carries a Retry-After header giving whole seconds until the block clears. Wait at least that long. It says when to come back, not what rate to aim for, and retrying sooner simply meets the block again.

This exists to stop abuse, and a well-behaved client should not reach it; if yours does, the fix is to reduce your request rate rather than to retry on a timer. If you believe your application needs a rate that trips it, contact Feed.fm rather than working around it.

default

An error occurred.