Yelp

Yelp OAuth Authorization v2 API

OAuth Authorization v2 operations documented in the Yelp developer reference: Revoke Access Token; Get Access Token v2; Get Access Token v3.

Documentation GitHub OpenAPI

Operations 2

POST /revoke Revoke Access Token #

POST /token Get Access Token v2 #

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/yelp:yelp-oauth-authorization-v2-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: OAuth Authorization v2 API
  version: '1.0'
servers:
- url: https://api.yelp.com/oauth2
tags:
- name: OAuth Authorization v2
paths:
  /revoke:
    post:
      tags:
      - OAuth Authorization v2
      summary: Revoke Access Token
      description: Revoke a given token.
      operationId: oauth2_revoke
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                client_id:
                  $ref: '#/components/schemas/client_id'
                client_secret:
                  $ref: '#/components/schemas/client_secret'
                token:
                  $ref: '#/components/schemas/token'
                  description: The access token to revoke.
                token_type_hint:
                  description: Token type identifier, optional.
                  enum:
                  - access_token
                  - refresh_token
                  type: string
              required:
              - client_id
              - client_secret
              - token
      responses:
        '200':
          description: A successful request doesn't return anything
          content:
            application/json:
              schema:
                type: object
        '400':
          $ref: '#/components/schemas/Error400'
        '429':
          $ref: '#/paths/~1token/post/responses/429'
        '500':
          $ref: '#/paths/~1token/post/responses/500'
      deprecated: false
  /token:
    post:
      tags:
      - OAuth Authorization v2
      summary: Get Access Token v2
      description: 'Either:

        1) Exchanges an authorization_code for an access_token, or

        2) Exchanges a refresh_token for an access_token.

        See Refresh Tokens for how this works'
      operationId: oauth2_token
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              oneOf:
              - $ref: '#/components/schemas/TokenAuthorizationCodeRequest'
              - $ref: '#/components/schemas/TokenRefreshTokenRequest'
      responses:
        '200':
          description: Token issued
          content:
            application/json:
              schema:
                oneOf:
                - $ref: '#/components/schemas/TokenAuthorizationCodeResponse'
                - $ref: '#/components/schemas/TokenRefreshTokenResponse'
              examples:
                Authorization Code Example:
                  $ref: '#/components/examples/TokenAuthorizationCodeResponse'
                Refresh Token Example:
                  $ref: '#/components/examples/TokenRefreshTokenResponse'
        '400':
          $ref: '#/components/schemas/Error400'
        '429':
          description: You have either exceeded your daily quota, or have exceeded the queries-per-second limit for this endpoint. Try reducing the rate at which you make queries.
          content:
            application/json:
              examples:
                Rate limited:
                  value:
                    error:
                      code: TOO_MANY_REQUESTS_PER_SECOND
                      description: You have exceeded the queries-per-second limit for this endpoint. Try reducing the rate at which you make queries.
              schema:
                $ref: '#/components/schemas/Error400/content/application~1json/schema'
        '500':
          description: Internal Server Error
          content:
            application/json:
              examples:
                Internal Server Error:
                  value:
                    error:
                      code: INTERNAL_ERROR
                      description: Something went wrong internally, please try again later.
              schema:
                $ref: '#/components/schemas/Error400/content/application~1json/schema'
      deprecated: false
components:
  schemas:
    client_secret:
      type: string
      description: Client secret assigned by Yelp for the third-party system that will make user-authorized requests to Yelp.
      maxLength: 64
      minLength: 64
    TokenAuthorizationCodeResponse:
      title: Response when calling this endpoint using an authorization code.
      type: object
      allOf:
      - $ref: '#/components/schemas/TokenRefreshTokenResponse'
      - type: object
        properties:
          refresh_token:
            $ref: '#/components/schemas/token'
            description: Refresh token that can be used to refresh the access token. Refresh tokens expire after 365 days.
          refresh_token_expires_in:
            description: Seconds until refresh token expires.
            type: integer
          refresh_token_expires_on:
            description: The expiration time of the refresh token in ISO8601 format.
            type: string
            format: date-time
          scopes:
            description: Space separated scope values for the scope the business owner authorized the partner's application for.
            type: string
        required:
        - refresh_token
        - refresh_token_expires_in
        - refresh_token_expires_on
        - scopes
    Error400:
      description: Bad Request
      content:
        application/json:
          examples:
            INVALID_REQUEST:
              value:
                error:
                  code: INVALID_REQUEST
                  description: '''refresh_token'' parameter not specified'
            INVALID_GRANT:
              value:
                error:
                  code: INVALID_GRANT
                  description: The grant type you provided is invalid, expired or revoked.
            UNSUPPORTED_GRANT_TYPE:
              value:
                error:
                  code: UNSUPPORTED_GRANT_TYPE
                  description: The authenticated client is not authorized to use this authorization grant type.
            BAD_CLIENT_ID_OR_SECRET:
              value:
                error:
                  code: BAD_CLIENT_ID_OR_SECRET
                  description: Invalid combination of client_id and client_secret.
            UNAUTHORIZED_CLIENT:
              value:
                error:
                  code: UNAUTHORIZED_CLIENT
                  description: Specified client is not authorized.
          schema:
            type: object
            properties:
              error:
                type: object
                required:
                - code
                - description
                properties:
                  code:
                    type: string
                    description: The error code.
                  description:
                    type: string
                    description: The description of the error.
    TokenRefreshTokenResponse:
      title: Response when calling this endpoint using a refresh token.
      type: object
      properties:
        access_token:
          $ref: '#/components/schemas/token'
          description: Token issued by the authorization server. Tokens will be valid for 7 days.
        expires_in:
          description: Seconds until token expires.
          type: integer
        expires_on:
          description: The expiration time of the access token in ISO8601 format.
          type: string
          format: date-time
        token_type:
          description: The type of token issued. Default to ‘Bearer’
          type: string
      required:
      - access_token
      - expires_in
      - expires_on
      - token_type
    token:
      type: string
      maxLength: 128
      minLength: 128
      pattern: '[A-Za-z0-9+/=]+'
    client_id:
      type: string
      description: ID assigned by Yelp for the third-party system that will make user-authorized requests to Yelp.
    TokenRefreshTokenRequest:
      title: Refresh Access Token Request
      type: object
      description: Refresh Access Token Request as per https://www.rfc-editor.org/rfc/rfc6749#section-6
      allOf:
      - $ref: '#/components/schemas/TokenRequestBase'
      - type: object
        properties:
          grant_type:
            type: string
            description: Value MUST be set to "refresh_token".
            enum:
            - refresh_token
          refresh_token:
            type: string
            description: The refresh token issued to the client.
          scope:
            type: string
            description: "Clients can specify a smaller subset of scopes, if desired. However, they cannot\n    specify any scopes that were not previously defined. If not specified, the original scope is returned.\n"
        required:
        - authorization_code
        - refresh_token
    TokenAuthorizationCodeRequest:
      title: Access Token Request
      type: object
      description: Access Token Request as per https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3
      allOf:
      - $ref: '#/components/schemas/TokenRequestBase'
      - type: object
        properties:
          grant_type:
            type: string
            description: Value MUST be set to "authorization_code".
            enum:
            - authorization_code
          code:
            type: string
            description: Authorization code that is sent back to the redirect uri after a biz user authorized the client's oauth client.
          redirect_uri:
            type: string
            description: REQUIRED, if the "redirect_uri" parameter was included in the authorization request and their values MUST be identical.
          code_verifier:
            type: string
            description: 'PKCE code verifier (RFC 7636). The original random string used to generate the

              code_challenge sent in the authorization request. Required when the authorization

              request included a code_challenge. Must be between 43 and 128 characters,

              using [A-Z] / [a-z] / [0-9] / "-" / "." / "_" / "~".

              '
            minLength: 43
            maxLength: 128
            pattern: ^[A-Za-z0-9\-._~]+$
          code_challenge_method:
            type: string
            description: 'The method used to derive the code_challenge from the code_verifier.

              Only S256 is supported.

              '
            enum:
            - S256
        required:
        - authorization_code
        - code
    TokenRequestBase:
      type: object
      properties:
        client_id:
          $ref: '#/components/schemas/client_id'
        client_secret:
          $ref: '#/components/schemas/client_secret'
        grant_type:
          type: string
          enum:
          - authorization_code
          - refresh_token
          description: Grant type, as per specified in OAuth2 RFC.
      required:
      - client_id
      - client_secret
      - grant_type
  examples:
    TokenRefreshTokenResponse:
      value:
        access_token: AfzWrtxA8kNHtswWExRUsRGKq43YuLI37y8ko6JDOxWZvGIX8ERwlOyUADmf5V6kaAdfIKafmmCjf4s8JGvkUugqBhoyO1WImlHg5i7g5QHRl07vG95rpTYMtIo3uo5H
        expires_in: 604799
        expires_on: '2022-11-10T12:29:56+00:00'
        token_type: Bearer
    TokenAuthorizationCodeResponse:
      value:
        access_token: AfzWrtxA8kNHtswWExRUsRGKq43YuLI37y8ko6JDOxWZvGIX8ERwlOyUADmf5V6kaAdfIKafmmCjf4s8JGvkUugqBhoyO1WImlHg5i7g5QHRl07vG95rpTYMtIo3uo5H
        expires_in: 604799
        expires_on: '2022-11-10T12:29:56+00:00'
        token_type: Bearer
        refresh_token: sMJDp1qSPQuZ1rAJlJToX2wLFu1S6HRPFC9UlCkN8VP3wh4qqN2Ba4J1Jc5NcVixkw9CA4TGZ7zEKIq2mTyWHojzVcgnYLH2JVIhKGAfko9Uc1ANfvFtItpcgalKAP2W
        refresh_token_expires_in: 31535999
        refresh_token_expires_on: '2023-11-03T12:29:56+00:00'
        scope: leads r2r
x-provenance:
  method: searched
  source: https://docs.developer.yelp.com/reference
  harvested: '2026-11-05'
  tool: harvest-readme-openapi.py
  note: Assembled verbatim from the OpenAPI definition ReadMe embeds in each operation page of the provider's developer portal; paths and components merged by API title, nothing authored.
  assembled_from:
  - https://docs.developer.yelp.com/reference/oauth2_revoke.md
  - https://docs.developer.yelp.com/reference/oauth2_token.md
  - https://docs.developer.yelp.com/reference/oauth2_token_v3.md
  merge:
    pages: 3
    deduped: 16
    conflicts_kept_first: 0