{
  "info": {
    "_postman_id": "aifitnessapi-dexcom",
    "name": "Dexcom (aifitnessapi.com)",
    "description": "Dexcom: OAuth 2.0 requests built from the vendor documentation aifitnessapi.com quotes. Generated by scripts/build-collections.mjs; no secrets included. https://aifitnessapi.com/collections",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "item": [
    {
      "name": "OAuth 2.0",
      "description": "Dexcom's authorization-code flow as its documentation describes it, read 2026-11-05. Fill client_id, redirect_uri and scope in an environment of your own and keep client_secret there, never in a shared collection.\n\nThe same facts, with each source sentence, at https://aifitnessapi.com/integrate/dexcom-api and https://aifitnessapi.com/tools/oauth-playground.",
      "item": [
        {
          "name": "1. Authorization URL (open in a browser)",
          "request": {
            "method": "GET",
            "header": [],
            "url": {
              "raw": "https://api.dexcom.com/v3/oauth2/login?response_type=code&client_id={{client_id}}&redirect_uri={{redirect_uri}}&scope={{scope}}&state={{state}}",
              "protocol": "https",
              "host": [
                "api",
                "dexcom",
                "com"
              ],
              "path": [
                "v3",
                "oauth2",
                "login"
              ],
              "query": [
                {
                  "key": "response_type",
                  "value": "code"
                },
                {
                  "key": "client_id",
                  "value": "{{client_id}}"
                },
                {
                  "key": "redirect_uri",
                  "value": "{{redirect_uri}}"
                },
                {
                  "key": "scope",
                  "value": "{{scope}}"
                },
                {
                  "key": "state",
                  "value": "{{state}}"
                }
              ]
            },
            "description": "https://api.dexcom.com/v3/oauth2/login. Login URL for the US production environment; the sandbox replaces the base URL with https://sandbox-api.dexcom.com. Open this URL in a browser (in Postman: copy it from the request bar); the user signs in and Dexcom redirects to {{redirect_uri}} with ?code=… Put that value in the auth_code variable.\n\nSource: Dexcom Developer Portal, “Authentication”, https://developer.dexcom.com/docs/dexcom/authentication\n\nScope: One scope only: offline_access, always sent. Source: Dexcom Developer Portal, “Authentication”, https://developer.dexcom.com/docs/dexcom/authentication\n\nRequired scope: offline_access (the scope variable starts with it).\n\nPKCE: Not mentioned. Dexcom also requires tokens and the client secret to live on your server, not on a phone.\n\nAlso documented: https://sandbox-api.dexcom.com/v3/oauth2/login. Sandbox login (no password; a drop-down of sandbox users). Source: Dexcom Developer Portal, “Authentication”, https://developer.dexcom.com/docs/dexcom/authentication"
          },
          "response": []
        },
        {
          "name": "2. Exchange the code for tokens",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/x-www-form-urlencoded",
                "type": "text"
              }
            ],
            "url": {
              "raw": "https://api.dexcom.com/v3/oauth2/token",
              "protocol": "https",
              "host": [
                "api",
                "dexcom",
                "com"
              ],
              "path": [
                "v3",
                "oauth2",
                "token"
              ]
            },
            "description": "https://api.dexcom.com/v3/oauth2/token. Token URL (US production), form-encoded, for the exchange and refresh.\n\nSource: Dexcom Developer Portal, “Authentication”, https://developer.dexcom.com/docs/dexcom/authentication\n\nClient credentials go in the form body.\n\nToken lifetime: expires_in is in seconds; Dexcom's sample response shows 7200 (two hours). Source: Dexcom Developer Portal, “Authentication”, https://developer.dexcom.com/docs/dexcom/authentication\n\nNote: The authorization code is single-use and expires after one minute. Source: Dexcom Developer Portal, “Authentication”, https://developer.dexcom.com/docs/dexcom/authentication\n\nNote: Tokens and the client secret must be stored on your servers, never on the mobile device. Source: Dexcom Developer Portal, “Authentication”, https://developer.dexcom.com/docs/dexcom/authentication\n\nNote: A refresh token is valid for at most one year. Source: Dexcom Developer Portal, “Authentication”, https://developer.dexcom.com/docs/dexcom/authentication",
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                {
                  "key": "grant_type",
                  "value": "authorization_code",
                  "type": "text"
                },
                {
                  "key": "code",
                  "value": "{{auth_code}}",
                  "type": "text"
                },
                {
                  "key": "redirect_uri",
                  "value": "{{redirect_uri}}",
                  "type": "text"
                },
                {
                  "key": "client_id",
                  "value": "{{client_id}}",
                  "type": "text"
                },
                {
                  "key": "client_secret",
                  "value": "{{client_secret}}",
                  "type": "text"
                }
              ]
            }
          },
          "response": []
        },
        {
          "name": "3. Refresh the access token",
          "request": {
            "method": "POST",
            "header": [
              {
                "key": "Content-Type",
                "value": "application/x-www-form-urlencoded",
                "type": "text"
              }
            ],
            "url": {
              "raw": "https://api.dexcom.com/v3/oauth2/token",
              "protocol": "https",
              "host": [
                "api",
                "dexcom",
                "com"
              ],
              "path": [
                "v3",
                "oauth2",
                "token"
              ]
            },
            "description": "Refresh: Each refresh token works once and is replaced by a new one; each lasts at most a year. A 400 on refresh means it is no longer valid: send the user through login again.\n\nSource: Dexcom Developer Portal, “Authentication”, https://developer.dexcom.com/docs/dexcom/authentication",
            "body": {
              "mode": "urlencoded",
              "urlencoded": [
                {
                  "key": "grant_type",
                  "value": "refresh_token",
                  "type": "text"
                },
                {
                  "key": "refresh_token",
                  "value": "{{refresh_token}}",
                  "type": "text"
                },
                {
                  "key": "client_id",
                  "value": "{{client_id}}",
                  "type": "text"
                },
                {
                  "key": "client_secret",
                  "value": "{{client_secret}}",
                  "type": "text"
                }
              ]
            }
          },
          "response": []
        }
      ]
    }
  ],
  "variable": [
    {
      "key": "client_id",
      "value": "",
      "type": "string",
      "description": "Your app's client ID, from the vendor's developer console."
    },
    {
      "key": "client_secret",
      "value": "",
      "type": "string",
      "description": "Keep it in a Postman or Bruno environment marked secret. This collection ships it empty."
    },
    {
      "key": "redirect_uri",
      "value": "",
      "type": "string",
      "description": "The redirect URI registered with the vendor."
    },
    {
      "key": "scope",
      "value": "offline_access",
      "type": "string",
      "description": "Scopes to request, joined as the vendor documents (see the authorization request)."
    },
    {
      "key": "state",
      "value": "",
      "type": "string",
      "description": "A random value you check on the redirect."
    },
    {
      "key": "auth_code",
      "value": "",
      "type": "string",
      "description": "The ?code= value from the redirect."
    },
    {
      "key": "refresh_token",
      "value": "",
      "type": "string",
      "description": "The refresh_token from the token response."
    }
  ]
}