---
title: "Issue or exchange an OAuth token"
method: POST
path: "/oauth/token"
tags: ["Authentication"]
---

# Issue or exchange an OAuth token

`POST /oauth/token`

## Request

- Base URL: `https://qveris.ai/api/v1`
- URL: `https://qveris.ai/api/v1/oauth/token`
- Auth: one of:
  - none
  - HTTP basic

Supports Authorization Code, Refresh Token, Device Code, and RFC 8693 Token Exchange. Token Exchange requires HTTP Basic authentication for a registered confidential Agent Runtime. Its subject_token, subject_token_type, resource, and scope fields are required together. Delegation tokens have a maximum 600-second lifetime and never include a refresh_token.

## Response `200`

Successful Response

- union
  - OAuthAccessTokenResponse: Authorization Code, Device Code, or Refresh Token success response.
    - `access_token` string, required
    - `token_type` 'Bearer', required
    - `expires_in` integer, required
    - `scope` string, required
    - `resource` string, required
    - `refresh_token` string, nullable
    - `refresh_token_expires_in` integer, nullable
    - `id_token` string, nullable
    - `resource_tokens` object, nullable
    - `tool_api_key` string, nullable
    - `tool_api_key_name` string, nullable
  - OAuthTokenExchangeResponse: Successful Agent-to-QVeris token exchange. This schema deliberately does not contain refresh_token: delegation tokens cannot be refreshed.
    - `access_token` string, required
    - `issued_token_type` 'urn:ietf:params:oauth:token-type:access_token', required
    - `token_type` 'Bearer', required
    - `expires_in` integer, required
    - `scope` string, required
    - `resource` string, required
    - `constraints` OAuthDelegationConstraints
      - `model` string, nullable
      - `tool_ids` string[], nullable
      - `provider_ids` string[], nullable
      - `run_id` string, nullable
      - `max_credits` integer, nullable

## Other responses

- `400`: OAuth request or grant error
- `401`: Client authentication or bearer-token error
- `403`: Subject token has insufficient scope
- `422`: Validation Error

---

[API](https://skmtc.dev/qveris/apis/qveris-public-rest-api.md) · [All operations](https://skmtc.dev/qveris/apis/qveris-public-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/qveris/apis/qveris-public-rest-api/revisions/7b78aeef092a?raw)