GIgitguardian
OAuth2

Exchange an authorization code for an access token.

Token endpoint as defined by RFC 6749 §4.1.3.

Exchange an authorization code (obtained from the authorization endpoint) for a GitGuardian Personal Access Token (PAT). The request and response follow the OAuth 2.0 spec.

This endpoint does not require authentication: the client authenticates itself by submitting the client_id (and client_secret for confidential clients) in the request body.

post/v1/oauth/token

Request

  • Base URL
    https://api.gitguardian.com
  • URL
    https://api.gitguardian.com/v1/oauth/token
  • Auth
    none required

Request body application/x-www-form-urlencoded

grant_type'authorization_code' required

Must be authorization_code.

codestring required

The authorization code received from the authorization endpoint.

redirect_uristring uri required

Must match the redirect_uri used when requesting the authorization code.

client_idstring required

The OAuth client identifier.

client_secretstring

The OAuth client secret. Required only for confidential clients (those registered with token_endpoint_auth_method=client_secret_post).

code_verifierstring required

PKCE code verifier (RFC 7636) whose hash matches the code_challenge sent to the authorization endpoint.

namestring

Optional name for the resulting personal access token.

lifetimeinteger

Optional lifetime of the resulting personal access token, in days. 0 means it never expires.

Example request

{
  "grant_type": "authorization_code",
  "code": "4/0Adeu5BWqv9oS...",
  "redirect_uri": "https://app.example.com/callback",
  "client_id": "gg_client_AbCdEf123456",
  "client_secret": "gg_secret_AbCdEf123456",
  "code_verifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
  "name": "My MCP client",
  "lifetime": 30
}

Response

Token successfully issued.

access_tokenstring required

The issued personal access token. Use it in the Authorization: Token <access_token> header for subsequent calls to the GitGuardian API.

token_type'Bearer' required
expires_ininteger nullable

Seconds until the access token expires. null if the token never expires.

typestring required

GitGuardian token type.

namestring required

Token name.

account_idinteger required

ID of the GitGuardian workspace the token belongs to.

expire_atstring date-time nullable

Expiration date of the token (null if it never expires).

scopestring[] required

Scopes granted to the token.

keystring required

Raw token value (legacy alias of access_token, kept for backwards compatibility).

expire_at_downsizedboolean required

true if the requested lifetime was capped by a workspace policy and the token expires earlier than requested.

Example response

{
  "access_token": "gg_pat_AbCdEf123456...",
  "token_type": "Bearer",
  "expires_in": 2592000,
  "type": "personal_access_token",
  "name": "My MCP client",
  "account_id": 1234,
  "expire_at": "2026-06-20T04:46:00+00:00",
  "scope": [
    "scan",
    "incidents:read"
  ]
}

Changes

No recorded changes to this operation across all 35 revisions of this API.