An AI client's code, with its PKCE verifier, or its refresh token, for new tokens (RFC 6749): a public client, known by its metadata document's URL. Errors are OAuth's

POST

/oauth/token

curl --request POST \
  --url https://example.com/oauth/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data client_id=example \
  --data code=example \
  --data code_verifier=example \
  --data grant_type=example \
  --data redirect_uri=example \
  --data refresh_token=example \
  --data resource=example

Who: anyone.

Request Body^required

Media typeapplication/x-www-form-urlencoded

object

client_id

required

string

code

string

code_verifier

string

grant_type

required

string

redirect_uri

string

refresh_token

string

resource

string

Example ^generated

client_id=example&code=example&code_verifier=example&grant_type=example&redirect_uri=example&refresh_token=example&resource=example

Responses

200

OK

Media typeapplication/json

object

access_token

required

string

expires_in

required

integer format: int64

refresh_token

required

string

scope

required

string

token_type

required

string

Example ^generated

{
  "access_token": "example",
  "expires_in": 1,
  "refresh_token": "example",
  "scope": "example",
  "token_type": "example"
}

400

A request OAuth refuses, in OAuth’s words

Media typeapplication/json

object

error

required

string

error_description

required

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

default

An error, as go-commons apperr maps it

Media typeapplication/json

object

error

required

object

code

required

string

fields

object

key

additional properties

string

message

required

string

Example ^generated

{
  "error": {
    "code": "example",
    "fields": {
      "additionalProperty": "example"
    },
    "message": "example"
  }
}