Accounts & authentication

Exchange or refresh an OAuth token

POST /oauth/token

Send an application/x-www-form-urlencoded request. For authorization_code, send client_id, code and code_verifier, and optionally redirect_uri and resource. For refresh_token, send client_id and refresh_token, and optionally resource. Codes expire after 60 seconds and refresh tokens rotate on use. A reused code revokes its grant only when its client, redirect, resource and verifier pass their checks, including after expiry. The answer is never cached. Errors use OAuth JSON, including invalid_request, invalid_client, invalid_grant, invalid_target, unsupported_grant_type and invalid_scope.

Parameters

Idempotency-Keyheader · optional · string

Makes a retry safe: a request with the same key and the same method, path, and body as an earlier one gets the earlier response instead of doing the work again. 1 to 255 visible ASCII characters; use a new key for each new request, such as a UUID. Keys are kept per caller for a day, and ignored for requests without credentials.

Minimum length: 1 · Maximum length: 255

Example request

curl --request POST 'https://commitscale.com/oauth/token'

Example values illustrate the format. Use your own credentials and identifiers.

Request body

application/x-www-form-urlencoded

Responses

200 An access token and rotated refresh token.

application/json

{
  "access_token": "example",
  "expires_in": 0,
  "refresh_token": "example",
  "scope": "example",
  "token_type": "example"
}

access_tokenrequired · string

The access token for this server's MCP resource.

expires_inrequired · integer (int32)

Seconds until the access token expires.

Minimum: 0

refresh_tokenrequired · string

The refresh token, rotated each time it is used.

scoperequired · string

Granted scopes separated by spaces.

token_typerequired · string

The token type, Bearer.

RateLimit and RateLimit-Policy describe the request rate. Follow Retry-After when a response asks you to wait.

Problem responses

Errors use application/problem+json. Act on the stable code, and follow next when present. See the problem format.

quota_exceeded429

With 429, the caller used its requests for the minute. With 422, a count limit was reached.

With 429, wait Retry-After seconds and retry. With 422, remove one first.