Get OAuth token

POST

/sdk/token

curl --request POST \
  --url https://api-uat.flinkey.de/v3/sdk/token \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'flinkey-API-Key: <flinkey-API-Key>' \
  --data '{ "customerId": 99001, "sdkKey": "sk_uat_example_key_12345", "userId": 54321 }'

• UAT — start all integrations here (Portal: https://portal-uat.flinkey.com)
• PROD — available after validation (Portal: https://portal.flinkey.com)

Purpose

Retrieve an OAuth ID token for SDK-based mobile access.

This operation is used by the partner backend to obtain an id_token for a specific flinkey user and customer context.

The returned id_token is used in the mobile SDK token exchange flow.

The partner mobile app must not call this operation directly with backend credentials.

The partner backend must request this token only after verifying that the current partner customer is allowed to access the requested vehicle.

When to use this operation

Use this operation when the partner mobile app needs mobile access context for SDK-based local vehicle access.

Typical situations:

• preparing the Android app for local BLE access,
• preparing the iOS app for local BLE access,
• starting a Tapkey Mobile SDK login flow,
• refreshing mobile access context,
• enabling a customer-facing vehicle access flow in the partner app.

Before calling this operation, the partner backend should have resolved:

• the correct customerId,
• the correct userId,
• the valid SDK Key from the flinkey Portal (UAT: https://portal-uat.flinkey.com | PROD: https://portal.flinkey.com),
• the partner customer identity,
• the partner vehicle access permission,
• the assignment state required by the partner flow.

Do not call this operation before backend access authorization has been checked.

Do not expose backend credentials to the mobile app.

Validation notes

PROD validation result:

• POST /sdk/token was successfully executed with flinkey-API-Key, Authorization: Bearer {{accessToken}} and Content-Type: application/json.
• The Customer-ID header was not required; the customer context was provided through customerId in the request body.
• The request body accepted customerId, sdkKey and userId as documented.
• The operation returned 200 OK with one JSON object containing id_token.
• id_token was returned as a string.
• The operation completed synchronously and did not produce a webhook result.
• The returned token is sensitive and must remain redacted in documentation, logs, screenshots, tickets and AI prompts.

Async behavior

Synchronous.

The OAuth ID token is returned directly in the API response.

Webhook result

No.

This operation does not produce a webhook result.

Security notes

Never log:

• flinkey-API-Key,
• bearer token,
• full request headers,
• sdkKey,
• id_token.

The id_token is sensitive.

Do not paste real tokens, SDK Keys or bearer tokens into documentation, examples, screenshots, tickets or AI prompts.

For standard partner integrations, the mobile app must not receive API Manager credentials, backend bearer tokens or the flinkey-API-Key.

The partner backend must validate partner-side access permission before returning mobile access context to the app.

Authorizations

• apiKey
• bearerAuth

Parameters

Header Parameters

Customer-ID

string

Customer context is provided in the request body

Request Body^required

Media typeapplication/json

object

customerId

required

Customer database ID

number

sdkKey

required

SDK Key from the flinkey Portal

string

userId

required

Database ID of the user

number

Example

{
  "customerId": 99001,
  "sdkKey": "sk_uat_example_key_12345",
  "userId": 54321
}

Responses

200

OAuth ID token was retrieved successfully

Media typeapplication/json

object

id_token

OAuth ID token used for the SDK token exchange flow

string

Example

{
  "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.example"
}

400

Invalid combination of customerId, sdkKey and userId

Recommended handling: Check SDK Key, customer context and user mapping

401

Invalid subscription key or missing / invalid access token

Recommended handling: Check flinkey-API-Key, bearer token and environment configuration

415

Request content type is missing or incorrect

Recommended handling: Ensure Content-Type: application/json is used

500

OAuth token could not be created or an internal server error occurred

Recommended handling: Retry later if appropriate and escalate if persistent