issueOAuthTokens

POST

/api/v1/oauth/token

curl --request POST \
  --url https://example.com/api/v1/oauth/token \
  --header 'Content-Type: application/json' \
  --data '{ "grant_type": "authorization_code", "client_id": "example", "code": "example", "redirect_uri": "https://example.com", "code_verifier": "example", "refresh_token": "example" }'

Public and rate-limited. Exchanges a single-use code with its PKCE verifier, or rotates a refresh token. PKCE is the client authentication for loopback clients. Reusing a rotated refresh token revokes the whole grant.

Request Body^required

Media typeapplication/json

object

grant_type

required

string

Allowed values: authorization_code refresh_token

client_id

string

code

string

redirect_uri

string format: uri

code_verifier

string

refresh_token

string

Responses

200

Opaque access and refresh tokens

Media typeapplication/json

object

data

required

object

access_token

required

string

refresh_token

required

string

token_type

required

string

Allowed values: Bearer

expires_at

required

string format: date-time

Example

{
  "data": {
    "token_type": "Bearer"
  }
}

400

Expired, used, mismatched, or revoked grant

429

Too many authentication attempts