Trade a code for a token

POST

/api/v1/oauth/token

curl --request POST \
  --url http://localhost:3000/api/v1/oauth/token

Form-encoded (or JSON). authorization_code with code_verifier, the device code grant, or refresh_token with the client_id it was issued to. The token is an API key bound to the person who consented: at most the scope they picked, never more than they can do. It works for expires_in seconds, an hour, and refresh_token renews it: each renewal answers a new pair and ends the old one, for as long as the agent renews within 90 days. A client that registered without the refresh_token grant gets a token for 30 days and no refresh token. resource, when sent, must be this server’s API (/api/v1/mcp), else invalid_target. Revoking it in Connections ends both.

No key needed.

Responses

200

The token

Media typeapplication/json

object

access_token

required

string

token_type

required

string

Allowed value: Bearer

scope

required

string

Allowed values: propose read write

expires_in

integer

>= -9007199254740991 <= 9007199254740991

refresh_token

string

Example

{
  "token_type": "Bearer",
  "scope": "propose"
}

default

An error

Media typeapplication/json

object

error

required

object

code

required

string

message

required

string

detail

Example^generated

{
  "error": {
    "code": "example",
    "message": "example",
    "detail": "example"
  }
}