Request Access Token

Acquires access token credentials for subsequent REST API calls.

URI Fragment

/request_token

Supported Signing Methods

3-legged Authorization Signing (with temporary credentials instead of access token)

Please refer here for the details of authentication flow and here for how to sign request to generate the Authorization header.

HTTP Method

POST

Request Header

The Authorization header is necessary for this call to succeed.
Content-Type: application/x-www-form-urlencoded

URL Query Parameters

None.

Request Body

None.

Response Status Code

HTTP Status Code	HTTP Status Message	Meaning
200	OK	Data successfully acquired
400	Bad Request	Corrupt request data on the client side
401	Unauthorized	Authorization error
403	Forbidden	The resource exists, but access is not possible due to a reason other than an authorization error.
500	Internal Server Error	An error on the API server side
503	Service Unavailable	The API cannot be used temporarily

Response Body

Content-Type: application/x-www-form-urlencoded

Parameter Name	Description
oauth_token	Access token for making subsequent REST API calls.
oauth_token_secret	Access token secret for signing subsequent REST API calls. This should be kept a secret and only your game server should know it.
oauth2_token	To be specified as the bearer token for Bank API calls. Please see the Bank API reference for details.

Please make sure you are managing the Token Credential (oauth_token, oauth2_token) per Session ID and not per User ID.
Following is a case study of inappropriate usage.

Condition
- Token Credential is stored per User ID in the database.
- The Token Credential in database is overwritten by the initialization of Android or iOS when proceeding 3-Legged OAuth.
State of Action
- User suspends the game in iOS and the starts the game in Android, and then goes back to iOS.
Consequence
- A miss match of Token Credential will occur and if the user purchases an Item from iOS, the Android game currency will be used instead of iOS game currency.

Notice that the Token Credential is tied per device in Mobage Platform. Therefor you can't share the same Token Credential between devices.
Incase you are managing the Token Credential per session ID then you don't need worry of such issue.

Example Request & Response

Base String

HTTP Request

HTTP Response