XQxquik-dev
Agent Discovery

Get an OAuth access token

Changed on

Exchange an authorization code, a refresh token, an agent claim token or an identity assertion for an access token.

post/api/oauth/token

Request

  • Base URL
    https://xquik.com
  • URL
    https://xquik.com/api/oauth/token
  • Auth
    none required

Request body application/x-www-form-urlencoded

OR
OR
OR

Example request

{
  "client_id": "550e8400-e29b-41d4-a716-446655440000",
  "client_secret": "CLIENT_SECRET",
  "client_assertion": "CLIENT_ASSERTION",
  "code": "AUTHORIZATION_CODE",
  "code_verifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
  "redirect_uri": "https://client.example/callback",
  "resource": "https://xquik.com/mcp"
}

Response

The access token. Code & refresh grants also return a new refresh token. A claim grant returns identity_assertion instead.

access_tokenstring required

Send it as a Bearer token.

token_type'Bearer' required
expires_ininteger required

Seconds until the access token expires.

scopestring required

The granted scopes, space-separated.

refresh_tokenstring

Only code & refresh grants return it. Each refresh token works once, so store the latest one.

identity_assertionstring

Only the claim grant returns it. Send it with the jwt-bearer grant for a new access token.

assertion_expiresstring date-time

When identity_assertion expires.

Example response

{
  "access_token": "ACCESS_TOKEN",
  "expires_in": 3600,
  "scope": "mcp:tools",
  "refresh_token": "REFRESH_TOKEN",
  "identity_assertion": "IDENTITY_ASSERTION",
  "assertion_expires": "2026-12-01T12:00:00.000Z"
}

Changes

  • 20d4bcaa8f4eRevision changes
    • breaking

      the response's property format changed from int64 to no format for status

    • info

      removed the non-success response with the status

  • 48f2012c62b3Revision changes
    • info

      added the non-success response with the status