oauth

Exchange a PKCE authorization code for a user-scoped API key.

Changed on
post/oauth/token

Request

  • Base URL: / (relative, and the document was published on a file host, not at the API’s origin)
  • URL: /oauth/token
  • Auth: HTTP bearer

Request body

codestring required

The authorization code received via the callback URL. We generate 256-bit codes, so anything shorter than ~32 chars is definitely not one of ours; the upper bound just defends the deserializer.

code_challenge_method'S256' | 'plain'

PKCE code challenge method supplied by the external app.

code_verifierstring required

The original PKCE verifier the external app generated. Length range matches RFC 7636 §4.1, which mandates 43–128 URL-safe characters.

Response

API key issued

keystring required

The newly-issued API key. Only returned once — store it securely.

key_idstring uuid required

ID of the API key record, for revocation via the admin API.

key_prefixstring required

User-facing prefix of the key (e.g. gw_abc...). Useful for display.

Changes