{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://artifacts.apis.io/internetdata-io/json-schema/internetdata-io-token-response-schema.json",
  "title": "TokenResponse",
  "x-generated": "2026-11-12",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/internetdata-io-openapi.yaml#/components/schemas/TokenResponse",
  "type": "object",
  "properties": {
    "access_token": {
      "type": "string"
    },
    "token_type": {
      "type": "string",
      "description": "Always `Bearer`."
    },
    "expires_in": {
      "type": "integer",
      "description": "Seconds until the access token expires."
    },
    "refresh_token": {
      "type": "string",
      "description": "Always returned. A refresh consumes the token it presents, so keep this one."
    },
    "scope": {
      "type": "string",
      "description": "What was actually granted, which may be narrower than what was asked for."
    },
    "mslm:apikey_id": {
      "type": "string",
      "description": "Not part of OAuth, and only for our own clients. The ID of the API\nkey the person picked when they approved, returned by every grant\nwhile this authorization may still read that key back. Absent when\nno key was picked, or when the person's role no longer allows\nreading keys back.\n"
    },
    "mslm:apikey": {
      "type": "string",
      "description": "Not part of OAuth, and only for our own clients: a client that signed\nin with a Client ID Metadata Document or registered itself never\nreceives a key. The API\nkey itself, so a device ends up holding an ordinary key. Returned by\nthe device code and authorization code grants only, never by a\nrefresh, and only alongside\n`mslm:apikey_id`. Absent when that key's secret cannot be read back,\nwhich is the case for a key created before keys could be shown again\nin the console; a rotated key can be.\n"
    }
  },
  "required": [
    "access_token",
    "token_type",
    "expires_in"
  ]
}