Required only if using the Refresh Token Grant.

Use the value of the previously stored refresh_token.

The alphanumeric client_id (may be sent in the body or via Authorization: Basic).

The alphanumeric client_secret (may be sent in the body or via Authorization: Basic).

A list of space-separated scopes that your application will have access to on behalf of the user.

Required only if using the Authorization Code Grant.

Use the value of the code parameter attached to callback request.

Required only for Authorization Code Grant when PKCE is used.

If code_challenge was provided in the /oauth/authorize request, you must include
the original code_verifier value here. If PKCE was not used (no code_challenge in
the authorization request), this parameter should be omitted.

Required only for the api_keys grant.

API Key generated in Penneo user settings.

Required only for the api_keys grant.

Concatenation of the raw nonce, timestamp, and API secret, then SHA-1 hashed, and finally
Base64-encoded. The nonce, while sent as a Base64-encoded string, is used in its raw form to
generate this digest.

Required only for the api_keys grant. Used to generate the digest parameter.

A randomly generated string, no longer than 64 characters. It should be sent Base64-encoded.

Required only for the api_keys grant. Used to generate the digest parameter.

Current date and time in UTC or including timezone. Most standard formats are supported.
A maximum clock skew of up to 60 seconds is allowed (in plus or minus).