AniList OAuth2 API

openapi: 3.2.0
info:
  title: AniList API v2 GraphQL O Auth2 API
  version: 2.0.0
  description: 'HTTP surface of the AniList API v2. The primary developer interface is a single GraphQL endpoint at https://graphql.anilist.co. OAuth2 authentication uses the Authorization Code and Implicit grant flows at https://anilist.co. This OpenAPI document captures the HTTP layer: the GraphQL POST endpoint, the OAuth2 authorize endpoint, the token exchange endpoint, and the auth pin redirect. The full GraphQL schema is profiled separately in `graphql/anilist-schema.graphql` (SDL) and `graphql/anilist-introspection.json` (introspection).'
  termsOfService: https://docs.anilist.co/guide/terms-of-use
  contact:
    name: AniList Support
    email: contact@anilist.co
    url: https://docs.anilist.co/
  license:
    name: AniList Terms of Use (free for non-commercial / commercial < $150/mo)
    url: https://docs.anilist.co/guide/terms-of-use
  x-generated-from: documentation
  x-last-validated: '2026-05-30'
  x-api-evangelist-profile: https://github.com/api-evangelist/anilist
servers:
- url: https://graphql.anilist.co
  description: AniList GraphQL endpoint (v2)
- url: https://anilist.co
  description: AniList OAuth2 authorization server
security:
- {}
- bearerAuth: []
tags:
- name: OAuth2
  description: OAuth2 authorization code and implicit grant endpoints
paths:
  /api/v2/oauth/authorize:
    get:
      operationId: oauthAuthorize
      summary: Begin the OAuth2 authorization flow
      description: Redirect a user to this endpoint to begin the OAuth2 Authorization Code or Implicit grant flow. The redirect URI must exactly match the URI configured on the developer application.
      tags:
      - OAuth2
      servers:
      - url: https://anilist.co
      parameters:
      - name: client_id
        in: query
        required: true
        description: The client ID of the developer application
        schema:
          type: string
      - name: redirect_uri
        in: query
        required: true
        description: Registered redirect URI for the application
        schema:
          type: string
          format: uri
      - name: response_type
        in: query
        required: true
        description: '`code` for Authorization Code Grant, `token` for Implicit Grant'
        schema:
          type: string
          enum:
          - code
          - token
      - name: state
        in: query
        required: false
        description: Opaque value the client can use to maintain state between request and callback
        schema:
          type: string
      responses:
        '302':
          description: Redirects to the configured redirect_uri with `code` (Authorization Code) or `#access_token` fragment (Implicit)
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/oauth/token:
    post:
      operationId: oauthExchangeToken
      summary: Exchange an authorization code for an access token
      description: Exchange an authorization code obtained from the authorize endpoint for an OAuth2 access token. AniList access tokens are JWTs valid for one year; refresh tokens are not supported.
      tags:
      - OAuth2
      servers:
      - url: https://anilist.co
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TokenRequest'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/TokenRequest'
      responses:
        '200':
          description: Token successfully issued
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '400':
          description: Invalid grant, client credentials, or redirect URI
        '401':
          description: Invalid client credentials
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
  /api/v2/oauth/pin:
    get:
      operationId: oauthAuthPin
      summary: Display the OAuth2 auth pin for manual entry
      description: Auth Pin redirect that displays an access token on a page for the user to copy and paste into a client application. Useful for clients that cannot register an HTTP or custom URI scheme redirect. Supports both Authorization Code and Implicit flows.
      tags:
      - OAuth2
      servers:
      - url: https://anilist.co
      responses:
        '200':
          description: HTML page displaying the access token
          content:
            text/html:
              schema:
                type: string
      x-microcks-operation:
        delay: 0
        dispatcher: FALLBACK
components:
  schemas:
    TokenRequest:
      title: TokenRequest
      type: object
      required:
      - grant_type
      - client_id
      - client_secret
      - redirect_uri
      - code
      properties:
        grant_type:
          type: string
          enum:
          - authorization_code
          example: authorization_code
        client_id:
          type: string
        client_secret:
          type: string
        redirect_uri:
          type: string
          format: uri
        code:
          type: string
          description: Authorization code received from the redirect
    TokenResponse:
      title: TokenResponse
      type: object
      properties:
        token_type:
          type: string
          example: Bearer
        expires_in:
          type: integer
          description: Token lifetime in seconds (1 year)
          example: 31536000
        access_token:
          type: string
          description: JWT access token
        refresh_token:
          type:
          - string
          - 'null'
          description: AniList does not currently support refresh tokens
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: OAuth2 access token issued by AniList. No scopes; access tokens grant (almost) full access to a user's data. Tokens are valid for one year.
    oauth2:
      type: oauth2
      description: AniList OAuth2 (no scopes supported)
      flows:
        authorizationCode:
          authorizationUrl: https://anilist.co/api/v2/oauth/authorize
          tokenUrl: https://anilist.co/api/v2/oauth/token
          scopes: {}
        implicit:
          authorizationUrl: https://anilist.co/api/v2/oauth/authorize
          scopes: {}