Stable Hosts

App MCP token endpoint

grant_type=authorization_code (with code_verifier) or refresh_token (rotates both tokens; a replayed refresh token revokes the grant). Opaque tokens: access 1 hour, grant at most 90 days.

post/_run402/oauth/token

Request

  • Base URL: https://api.run402.com
  • URL: https://api.run402.com/_run402/oauth/token
  • Auth: none required

Response

{access_token, refresh_token, token_type, expires_in, scope}, plus id_token (ES256, 5 minutes; iss this app's issuer, sub the user id, aud the client_id, auth_time, nonce, and email/email_verified or name/picture per scope) when the code was granted openid.

object required

Changes

No recorded changes to this operation across all 1 revision of this API.