OAuth

Exchange a code, or refresh

authorization_code requires the code_verifier, compared in constant time against the stored challenge. Redemption is a conditional UPDATE, so two concurrent exchanges of one code cannot both succeed. A code presented twice revokes the entire grant family: we cannot distinguish a broken client from an intercepted code, and the safe reading is the second.

refresh_token rotates. The presented token and its sibling access token are revoked as the replacement pair is issued, and presenting an already-revoked refresh token — the signature of a stolen copy — revokes the whole family, which makes the theft visible instead of silent.

Public clients only: send client_id in the body and no secret.

post/oauth/token

Request

  • Base URL: https://scanduro.com
  • URL: https://scanduro.com/oauth/token
  • Auth: HTTP bearer

Request body

grant_type'authorization_code' | 'refresh_token' required
codestring
code_verifierstring
redirect_uristring uri
refresh_tokenstring
client_idstring

Response

A fresh token pair. Never cached — the response carries a no-store cache directive.

access_tokenstring required

Of the form sndr_at_<prefix>_<secret>. Valid on /mcp and on /api/v1, always in live mode.

token_type'Bearer' required
expires_ininteger required
refresh_tokenstring

Of the form sndr_rt_<prefix>_<secret>. Rotated on every use. Refused as a bearer credential.

scopestring

Changes

No recorded changes to this operation across all 1 revision of this API.