---
title: "Oauth Token"
method: POST
path: "/oauth/token"
---

# Oauth Token

`POST /oauth/token`

## Request

- Base URL: `https://api.colourmemory.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.colourmemory.com/oauth/token`
- Auth: none declared

Exchange an existing API key for a bearer token (client_credentials).

KEPT, NOT DELETED. Nothing in this repository, the website source or the
Figma plugin references it, and the flow it was added for cannot have
been completing (its authorization endpoint 404s) -- but "no caller
found by static search" is not "usage proven absent", and the auth-scope
invariant is explicit that an authentication endpoint other product
surfaces might use is not removed on an assumption. Deleting it needs
production request-log evidence, which is admin-gated; see
docs/audit/anthropic_review_response.md for the exact query.

The empty-bearer defect IS fixed. An anonymous caller posting {} used to
receive 200 {"access_token": "", "token_type": "bearer"} -- a token that
authenticates nobody, handed out to anyone, and the single worst thing
for a reviewer to find on a server submitted as unauthenticated. A
caller that was passing a real key is unaffected.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/colourmemory/apis/colour-memory-api.md) · [All operations](https://skmtc.dev/colourmemory/apis/colour-memory-api/llms.txt) · [OpenAPI document](https://skmtc.dev/colourmemory/apis/colour-memory-api/revisions/4ba028f64042?raw)