Exchange an authorization code, device code, or refresh token

Use HTTP Basic client authentication when possible. client_secret_post remains supported for compatibility. Public device clients send client_id without a secret. Repeated parameters and multiple client authentication methods are rejected.

Account deactivation revokes personal API keys, including Agent Keys, and OAuth authorizations. Account reactivation requires new API keys, including new Agent Keys, and consent; previously issued credentials remain invalid.

Response Body

curl -X POST "https://example.com/api/oauth/token" \  -H "Content-Type: application/x-www-form-urlencoded" \  -d 'grant_type=authorization_code&code=string&redirect_uri=http%3A%2F%2Fexample.com'

{  "access_token": "string",  "token_type": "Bearer",  "expires_in": 1,  "refresh_token": "string",  "id_token": "string",  "scope": "string"}