Exchange credentials for an access token

POST

/v1/oauth/token

curl --request POST \
  --url https://api.adversarial.com/api/v1/oauth/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data client_id=example \
  --data client_secret=example \
  --data code=example \
  --data code_verifier=example \
  --data grant_type=example \
  --data redirect_uri=example \
  --data refresh_token=example \
  --data resource=example

• Production
• Staging
• Local

OAuth 2.1 token endpoint. The grant_type field selects the exchange:

• client_credentials: a service account exchanges its client_id and client_secret for an access and refresh token pair. This is the path API keys use.
• authorization_code: exchange an approved authorization code and its PKCE verifier for an access token and a refresh token.
• refresh_token: exchange a refresh token for a new pair. Refresh tokens issued to public clients rotate on each use, and replaying an already-used one revokes the whole chain.

Errors follow RFC 6749 §5.2 — an error code and error_description with the matching HTTP status — so standard OAuth clients can parse them. A malformed or wrongly-typed request body returns that same error shape rather than a generic validation failure.

Request Body^required

Media typeapplication/x-www-form-urlencoded

The request body for the token endpoint.

grant_type accepts any string rather than a fixed set. RFC 6749 §1.3 treats it as a URI extension point, so an unrecognized grant is reported as unsupported_grant_type — distinct from the invalid_request a malformed body gets.

object

client_id

string | null

client_secret

string | null

code

Authorization code (from the redirect after consent).

string | null

code_verifier

PKCE verifier — plaintext string whose S256 hash must match the code_challenge stored at authorize time.

string | null

grant_type

One of client_credentials, authorization_code, refresh_token. Other values are rejected with RFC 6749 §5.2 unsupported_grant_type.

string | null

redirect_uri

Redirect URI presented at authorize time. Must match exactly per RFC 6749 §4.1.3.

string | null

refresh_token

string | null

resource

RFC 8707 resource indicator. For client_credentials, lets a machine client bind its token to a specific MCP resource (e.g. <origin>/mcp) so it satisfies that resource’s audience check at use time. The authorization_code path takes the resource from the authorize request via the stored code row instead, so this field is read only for client_credentials.

string | null

Example^generated

client_id=example&client_secret=example&code=example&code_verifier=example&grant_type=example&redirect_uri=example&refresh_token=example&resource=example

Responses

200

Token pair generated successfully

Media typeapplication/json

object

access_token

required

string

expires_in

required

integer format: int64

refresh_token

required

string

scope

string | null

token_type

required

string

Example^generated

{
  "access_token": "example",
  "expires_in": 1,
  "refresh_token": "example",
  "scope": "example",
  "token_type": "example"
}

400

Invalid request

401

Invalid credentials