OAuth
Token
`authorization_code` (with the PKCE verifier; a code works once, a second use revokes what the first issued) and `refresh_token` (rotation: the old refresh token stops; presenting it again revokes the whole family). Access tokens last `OAUTH_ACCESS_TOKEN_TTL_SECONDS` (default 1 hour), refresh tokens `OAUTH_REFRESH_TOKEN_TTL_DAYS` (default 30).
API key access
This route has its own authentication (or none); an API key is not used here.
POST
/api/v1/oauth/tokengrant_typestring
authorization_code or refresh_token.
client_idstring
Or HTTP Basic (the secret is ignored).
code?string | null
authorization_code: the code from the redirect.
redirect_uri?string | null
authorization_code: must equal the authorization request's.
code_verifier?string | null
authorization_code: the PKCE verifier (S256).
refresh_token?string | null
refresh_token.
scope?string | null
refresh_token: a subset of the granted scopes.
resource?string | null
RFC 8707: the MCP endpoint.
Response Body
curl -X POST "http://localhost:8000/api/v1/oauth/token" \ -H "Content-Type: application/x-www-form-urlencoded" \ -d 'grant_type=string&client_id=string'{
"access_token": "string",
"token_type": "string",
"expires_in": 0,
"refresh_token": "string",
"scope": "string"
}{
"error": "string",
"error_description": "string"
}{
"error": "string",
"error_description": "string"
}