Sketchfab OAuth 2.0 API

openapi: 3.1.0
info:
  title: Sketchfab Download OAuth API
  description: 'Programmatic download of downloadable Sketchfab models in glTF, GLB, and USDZ formats. The endpoint returns short-lived signed URLs for each available format. The caller must be authenticated on behalf of an end user (OAuth Authorization Code or Implicit flow); application-level downloads without user authentication require a direct contract with Sketchfab. Source formats (FBX, OBJ) are not exposed.

    '
  version: v3
  contact:
    name: Sketchfab Developer Support
    url: https://support.fab.com/s/?ProductOrigin=Sketchfab
  license:
    name: Sketchfab Developer Terms of Use
    url: https://sketchfab.com/developers/terms
servers:
- url: https://api.sketchfab.com
  description: Production API
security:
- OAuth2: []
tags:
- name: OAuth
  description: OAuth 2.0 authorization and token endpoints.
paths:
  /oauth2/authorize/:
    get:
      summary: OAuth Authorize Endpoint
      description: Initiate the Authorization Code or Implicit flow. The end user is presented with the Sketchfab consent screen and on approval the browser is redirected back to the registered redirect_uri with either a `code` query parameter or an `access_token` URL fragment.
      operationId: oauthAuthorize
      tags:
      - OAuth
      parameters:
      - name: response_type
        in: query
        required: true
        description: '`code` (Authorization Code) or `token` (Implicit).'
        schema:
          type: string
          enum:
          - code
          - token
      - name: client_id
        in: query
        required: true
        schema:
          type: string
      - name: redirect_uri
        in: query
        required: false
        description: Redirect URI registered with the OAuth application.
        schema:
          type: string
          format: uri
      - name: state
        in: query
        description: Recommended CSRF / replay protection nonce.
        schema:
          type: string
      - name: approval_prompt
        in: query
        description: Set to `force` to always re-prompt the user for consent.
        schema:
          type: string
      responses:
        '302':
          description: Redirect to the application's redirect_uri carrying `code` or `access_token`.
  /oauth2/token/:
    post:
      summary: OAuth Token Endpoint
      description: Exchange an authorization code for tokens, refresh an access token, or perform a password grant. Requires Content-Type `application/x-www-form-urlencoded`.
      operationId: oauthToken
      tags:
      - OAuth
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - grant_type
              - client_id
              - client_secret
              properties:
                grant_type:
                  type: string
                  enum:
                  - authorization_code
                  - refresh_token
                  - password
                client_id:
                  type: string
                client_secret:
                  type: string
                code:
                  type: string
                  description: Authorization code (authorization_code grant).
                redirect_uri:
                  type: string
                  format: uri
                refresh_token:
                  type: string
                  description: Refresh token (refresh_token grant).
                username:
                  type: string
                  description: Sketchfab username (password grant).
                password:
                  type: string
                  description: Sketchfab password (password grant).
      responses:
        '200':
          description: Token response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/TokenResponse'
        '400':
          description: Invalid request or grant.
components:
  schemas:
    TokenResponse:
      type: object
      properties:
        access_token:
          type: string
        token_type:
          type: string
          example: Bearer
        expires_in:
          type: integer
          description: Lifetime of the access token in seconds (typically 30 days).
        refresh_token:
          type: string
          description: Issued for Authorization Code and Password grants only.
        scope:
          type: string
  securitySchemes:
    OAuth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://sketchfab.com/oauth2/authorize/
          tokenUrl: https://sketchfab.com/oauth2/token/
          refreshUrl: https://sketchfab.com/oauth2/token/
          scopes:
            read: Read access including model downloads.