Exchange OAuth authorization code, device code, or refresh token.
POST /oauth/token
Exchange OAuth authorization code, device code, or refresh token.
Access
Section titled “Access”This operation does not declare a credential requirement in the released API contract.
Provider access, workspace membership, and agent grants are enforced separately. A token does not expand access to a repository or resource. Set up developer access.
Request body
Section titled “Request body”Required. Supported content types: application/json, application/x-www-form-urlencoded.
| Field | Type | Required | Description |
|---|---|---|---|
grant_type |
"authorization_code" · "refresh_token" · "urn:ietf:params:oauth:grant-type:device_code" |
Yes | |
code |
string | No | |
redirect_uri |
string | No | Format: uri. |
client_id |
string | No | |
code_verifier |
string | No | |
refresh_token |
string | No | |
device_code |
string | No | |
resource |
string | No |
Call the endpoint
Section titled “Call the endpoint”Replace path placeholders and your credential. For body operations, create request.json using the required fields above; this command does not invent resource identifiers or consent.
curl --request POST \ 'https://commentary.dev/oauth/token' \ --header 'Content-Type: application/json' \ --data-binary @request.jsonResponses
Section titled “Responses”| Status | Meaning | Payload |
|---|---|---|
200 |
Successful response. | OAuthToken |
400 |
OAuth request error. | OAuthError |
401 |
OAuth token exchange was rejected. | OAuthError |
429 |
The request was rate limited. | OAuthError |
Successful response fields
Section titled “Successful response fields”| Field | Type | Required | Description |
|---|---|---|---|
access_token |
string | Yes | |
refresh_token |
string | Yes | |
token_type |
"Bearer" |
Yes | |
expires_in |
integer | Yes | |
scope |
string | Yes | Space-delimited scopes actually granted to this token. Registered OAuth clients may receive a subset of requested scopes. |
Recover from errors
Section titled “Recover from errors”Use the returned status and error body. Correct invalid fields before retrying; reconnect or narrow the target for authentication and permission errors. For conditional writes, reload the latest version before preparing a new request. Respect rate-limit headers and retry only when the operation’s idempotency contract permits it.
Contract and related guidance
Section titled “Contract and related guidance”Operation ID: exchangeOAuthToken. Download the OpenAPI contract for complete constraints and code generation. Browse endpoints.