Sign in
auth

[cloud-only] Exchange authorization code or refresh token for a resource-bound access token

[cloud-only] OAuth 2.1 token endpoint (RFC 6749 §3.2). Public clients only — client_secret is rejected.

Two grant types are supported:

  • authorization_code — exchanges the code minted by /oauth/authorize (with PKCE verifier) for an access token + first refresh token. Single-use; reuse fails closed.
  • refresh_token — rotates the refresh token. Old token immediately invalid; presenting an already-rotated token revokes the entire token family and emits a security metric.

Both grant types re-validate canonical user state, current workspace membership, and the resource's active flag at every mint. A code or refresh token bound to a deactivated resource fails closed.

Errors follow RFC 6749 §5.2. Logs never contain raw codes, refresh tokens, or minted tokens.

Per RFC 6749 §5.1, every 200 and 400 response carries Cache-Control: no-store and Pragma: no-cache so intermediaries cannot cache token-bearing or state-change-reason responses.

post/oauth/token

Response

New token pair

access_tokenstring required

Resource-bound access token (audience matches the protected resource).

token_type'Bearer' required
expires_ininteger required

Access token lifetime in seconds.

refresh_tokenstring required

Opaque refresh token. Rotates on every successful refresh; presenting an already-rotated token revokes the entire family.

scopestring required

Space-delimited scopes granted with this token.

Changes