Authentication

Exchange an authorization code or refresh token for an access token

OAuth 2.0 token endpoint. Supports exactly two grants — authorization_code (PKCE S256, single-use codes) and refresh_token (rotating). There is no client_credentials grant; presenting one returns unsupported_grant_type.

The issued access_token is an rm_user_* API key valid for 1 hour, usable as Authorization: Bearer … against any endpoint in this spec. The refresh_token is valid for 30 days and rotates on every use — replaying an already-rotated refresh token revokes the whole token family for that user/client pair (RFC 6819 §5.2.2.3).

Accepts either application/x-www-form-urlencoded or application/json. Responses are Cache-Control: no-store. Rate limited to 60 requests per IP per minute.

post/oauth/token

Request

Base URL: https://riskmodels.app/api
URL: https://riskmodels.app/api/oauth/token
Auth: none required

Request body

grant_type'authorization_code' | 'refresh_token' required

client_credentials is not supported and returns unsupported_grant_type.

codestring

Single-use authorization code (authorization_code grant).

redirect_uristring uri

Must match the URI the code was issued for (authorization_code grant).

client_idstring uuid

Client id from POST /api/oauth/register.

code_verifierstring

PKCE verifier; must hash (S256) to the registered code_challenge.

refresh_tokenstring

Rotating refresh token (refresh_token grant).

Response

Access token issued

access_tokenstring

An rm_user_* API key. Use directly as Authorization: Bearer … against any endpoint in this spec.

token_type'Bearer'

expires_ininteger

Access token lifetime in seconds (3600 = 1 hour).

refresh_tokenstring

Valid 30 days and rotated on every use. Replaying a rotated token revokes the whole family for that user/client pair.

scopestring

Example response

{
  "access_token": "rm_user_live_abc123_xyz789",
  "expires_in": 3600,
  "scope": "mcp:read"
}

Changes

No recorded changes to this operation across all 1 revision of this API.