oauth

Token

Exchange an authorization code for an access token.

Form-encoded, per RFC 6749 §4.1.3 — not JSON, which is what every compliant client sends and what this therefore has to read.

The token minted here is an ordinary ApiKey row, which is what makes the whole design cheap: no second principal path, no new gate, and the owner can revoke it from the Account → API keys screen on day one. It is minted through oauth.issue_for_grant and never through api_key.mint directly — see that function for the escalation the shortcut produces.

post/token

Request

  • Base URL: https://app.zeno-works.ch (the document declares no server; this is the origin it was published from)
  • URL: https://app.zeno-works.ch/token
  • Auth: none declared

Response

Successful Response

access_tokenstring required
token_typestring
expires_ininteger required
scopestring required
refresh_tokenstring nullable

Changes

No recorded changes to this operation across all 1 revision of this API.