Agents

Exchange an authorization code or a refresh token for an access token

grant_type=authorization_code (with the PKCE code_verifier) or grant_type=refresh_token. The access token is an ES256 JWT that lives 15 minutes and is verified locally against /.well-known/jwks.json; it carries the tenant, the application the grant is bound to, the grant, the scopes and aud. A refresh token rotates: every refresh returns a new one and retires the old, and presenting a retired one again revokes the whole grant (a client racing itself within ten seconds is only refused). Errors use the RFC 6749 envelope.

post/oauth/agent/token

Request

  • Base URL: https://api.customdomain.ai
  • URL: https://api.customdomain.ai/oauth/agent/token
  • Auth: none required

Request body

grant_type'authorization_code' | 'refresh_token' required
client_idstring required
codestring

With authorization_code: the single use code from the redirect. It lives 5 minutes.

code_verifierstring

With authorization_code: the PKCE verifier for the code_challenge sent to authorize.

redirect_uristring uri

With authorization_code: exactly the redirect_uri sent to authorize.

refresh_tokenstring

With refresh_token: the latest refresh token. It is good for one exchange.

Response

The tokens

access_tokenstring required

An ES256 JWT. Verify it against /.well-known/jwks.json.

token_type'Bearer' required
expires_ininteger required

Seconds the access token lives (900).

refresh_tokenstring

A new refresh token. The one just used no longer works.

scopestring

The scopes the grant carries, separated by spaces.

Changes

No recorded changes to this operation across all 1 revision of this API.