oauth

Token

Exchange a PKCE authorization code or rotate a refresh token.

No-store caching headers are applied by NoStoreAuthMiddleware for every response under /oauth, not set here.

post/oauth/token

Request

Request body application/x-www-form-urlencoded

grant_typestring required
codestring nullable
refresh_tokenstring nullable
client_idstring nullable
redirect_uristring nullable
code_verifierstring nullable
resourcestring nullable

Response

Successful Response

access_tokenstring required
token_type'Bearer'
expires_ininteger required
scopestring required
refresh_tokenstring nullable

Changes

No recorded changes to this operation across all 8 revisions of this API.