Slash Oauth2 API
The Oauth2 API from Slash — 2 operation(s) for oauth2.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/joinslash-com:joinslash-com-oauth2-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Slash Public Oauth2 API
description: API description
version: 0.0.1
contact: {}
servers:
- url: https://api.slash.com
description: production
security:
- api_key: []
- partner_api_key: []
- bearer: []
- developer_application: []
tags:
- name: OAuth2
paths:
/oauth2/token:
x-reference-path: paths/oauth2/token/route.yaml
post:
description: Get or refresh an access token. Confidential clients authenticate with HTTP Basic (client ID and secret). Public clients, which have no secret, send `client_id` in the body instead; their authorization codes must have been requested with a PKCE challenge.
requestBody:
required: true
content:
application/x-www-form-urlencoded:
schema:
oneOf:
- type: object
properties:
grant_type:
type: string
enum:
- authorization_code
code:
type: string
client_id:
description: Required for public clients, which don't send HTTP Basic credentials. Ignored when HTTP Basic credentials are sent.
type: string
code_verifier:
description: The PKCE code verifier. Required when the authorization code was requested with a code challenge.
type: string
resource:
description: The protected resource the token is for (RFC 8707). MCP clients send it; it is accepted and not otherwise used.
type: string
prompt:
description: Unused by Slash, but required in the OAuth spec.
type: string
scope:
description: Unused by Slash, but required in the OAuth spec.
type: string
redirect_uri:
type: string
required:
- grant_type
- code
- redirect_uri
- type: object
properties:
grant_type:
type: string
enum:
- refresh_token
refresh_token:
type: string
client_id:
description: Required for public clients, which don't send HTTP Basic credentials. Ignored when HTTP Basic credentials are sent.
type: string
resource:
description: The protected resource the token is for (RFC 8707). MCP clients send it; it is accepted and not otherwise used.
type: string
scope:
description: Unused by Slash, but required in the OAuth spec.
type: string
code:
description: Unused by Slash, but required in the OAuth spec.
type: string
code_verifier:
description: Unused by Slash, but required in the OAuth spec.
type: string
prompt:
description: Unused by Slash, but required in the OAuth spec.
type: string
redirect_uri:
description: Unused by Slash, but required in the OAuth spec.
type: string
required:
- grant_type
- refresh_token
responses:
'200':
description: OK
content:
application/json:
schema:
type: object
properties:
access_token:
type: string
token_type:
type: string
enum:
- Bearer
expires_in:
type: integer
id_token:
type: string
refresh_token:
type: string
required:
- access_token
- token_type
- expires_in
- id_token
- refresh_token
'400':
description: 'The authorization code or refresh token can''t be used: it''s invalid, expired, already used, revoked, or was issued to another client. Send the user through authorization again (RFC 6749 section 5.2).'
content:
application/json:
schema:
type: object
properties:
error:
type: string
enum:
- invalid_grant
required:
- error
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'429':
description: TooManyRequests
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'500':
description: Internal Error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
security:
- developer_application: []
tags:
- OAuth2
summary: Create oauth2 token
x-summary-source: derived
operationId: postOauth2Token
x-operation-id-source: derived
/oauth2/userinfo:
x-reference-path: paths/oauth2/userinfo/route.yaml
get:
description: Get userinfo
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/paths.oauth2.userinfo._dto.UserInfoResponse'
x-entrypoint:
virtualPath: paths/oauth2/userinfo/_dto/UserInfoResponse
sourcePath: paths/oauth2/userinfo/_dto/UserInfoResponse.yaml
title: UserInfoResponse
origin: ./src/publicApi
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'429':
description: TooManyRequests
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'500':
description: Internal Error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
security:
- bearer: []
tags:
- OAuth2
summary: Get oauth2 userinfo
x-summary-source: derived
operationId: getOauth2Userinfo
x-operation-id-source: derived
post:
description: Get userinfo
responses:
'200':
description: OK
content:
application/json:
schema:
$ref: '#/components/schemas/paths.oauth2.userinfo._dto.UserInfoResponse'
x-entrypoint:
virtualPath: paths/oauth2/userinfo/_dto/UserInfoResponse
sourcePath: paths/oauth2/userinfo/_dto/UserInfoResponse.yaml
title: UserInfoResponse
origin: ./src/publicApi
'401':
description: Unauthorized
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'403':
description: Forbidden
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'429':
description: TooManyRequests
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
'500':
description: Internal Error
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
security:
- bearer: []
tags:
- OAuth2
summary: Create oauth2 userinfo
x-summary-source: derived
operationId: postOauth2Userinfo
x-operation-id-source: derived
components:
schemas:
Error:
type: object
properties:
message:
type: string
name:
type: string
identifier:
type: string
rawStatus:
type: number
meta:
type: object
additionalProperties: true
required:
- message
- name
- identifier
- rawStatus
x-entrypoint:
origin: ./src/publicApi
sourcePath: ./src/publicApi/main.yaml
title: Error
virtualPath: components/Error
title: Error
paths.oauth2.userinfo._dto.UserInfoResponse:
type: object
properties:
sub:
type: string
description: The user's ID
name:
type: string
description: The user's full name
email:
type: string
phone_number:
type: string
required:
- sub
- name
- email
x-entrypoint:
virtualPath: paths/oauth2/userinfo/_dto/UserInfoResponse
sourcePath: paths/oauth2/userinfo/_dto/UserInfoResponse.yaml
title: UserInfoResponse
origin: ./src/publicApi
title: UserInfoResponse
securitySchemes:
api_key:
type: apiKey
description: "API key authentication for public API requests.\n\nKeys come in two flavors:\n\n- *Legal-entity-scoped keys* are pinned to a single legal entity.\n Minted via the dashboard under a specific entity; every request\n acts on that entity.\n- *User-scoped keys* are pinned to a user and span every legal\n entity that user has access to. Every request made with a\n user-scoped key (except `GET /legal-entity`, which lists the\n legal entities the user can access) must include an\n `x-legal-entity` header naming the legal entity the request is\n operating on. Requests without the header are rejected with\n `400`. The authenticated user must have an active permission\n role on the supplied legal entity, otherwise the request is\n rejected with `403`.\n"
name: X-API-Key
in: header
partner_api_key:
type: apiKey
description: 'Partner-program API key authentication.
Keys are minted in the partner dashboard (Developers → API Keys),
are scoped to a single partner program, and are prefixed with
`sk_partner_`. Partner keys are only accepted by routes that
declare this scheme; they are rejected by `api_key` routes and
vice versa.
'
name: X-API-Key
in: header
bearer:
type: http
scheme: bearer
developer_application:
type: http
scheme: basic