POST /oauth/token
Supports Authorization Code, Refresh Token, Device Code, and RFC 8693 Token Exchange. Token Exchange requires HTTP Basic authentication for a registered confidential Agent Runtime. Its subject_token, subject_token_type, resource, and scope fields are required together. Delegation tokens have a maximum 600-second lifetime and never include a refresh_token.
REST API overview · OpenAPI JSON · OpenAPI YAML
| Stability | Authentication | Cost | Operation ID |
|---|---|---|---|
| Published | Client ID; HTTP Basic for confidential clients | Free | token_api_v1_oauth_token_post |
This operation has no path or query parameters.
Schema: inline
Grant variant: authorization_code
| Name | Required | Type | Description |
|---|---|---|---|
grant_type | Yes | string | — |
code | Yes | string | — |
redirect_uri | Yes | string | — |
code_verifier | Yes | string | — |
client_id | No | string | — |
Grant variant: refresh_token
| Name | Required | Type | Description |
|---|---|---|---|
grant_type | Yes | string | — |
refresh_token | Yes | string | — |
client_id | No | string | — |
Grant variant: urn:ietf:params:oauth:grant-type:device_code
| Name | Required | Type | Description |
|---|---|---|---|
grant_type | Yes | string | — |
device_code | Yes | string | — |
client_id | No | string | — |
Grant variant: urn:ietf:params:oauth:grant-type:token-exchange
| Name | Required | Type | Description |
|---|---|---|---|
grant_type | Yes | string | — |
subject_token | Yes | string | — |
subject_token_type | Yes | string | — |
requested_token_type | No | string | — |
resource | Yes | string | — |
scope | Yes | string | — |
model | No | string | — |
run_id | No | string | — |
max_credits | No | integer | — |
tool_ids | No | string[] | — |
provider_ids | No | string[] | — |
curl --request POST \
--url "https://qveris.ai/api/v1/oauth/token" \
--data-urlencode 'grant_type=authorization_code' \
--data-urlencode 'code=YOUR_AUTHORIZATION_CODE' \
--data-urlencode 'redirect_uri=YOUR_REGISTERED_REDIRECT_URI' \
--data-urlencode 'code_verifier=YOUR_PKCE_CODE_VERIFIER' \
--data-urlencode 'client_id=YOUR_CLIENT_ID'
const response = await fetch("https://qveris.ai/api/v1/oauth/token", {
method: "POST",
body: new URLSearchParams(Object.entries({
"grant_type": "authorization_code",
"code": "YOUR_AUTHORIZATION_CODE",
"redirect_uri": "YOUR_REGISTERED_REDIRECT_URI",
"code_verifier": "YOUR_PKCE_CODE_VERIFIER",
"client_id": "YOUR_CLIENT_ID"
}).map(([key, value]) => [key, String(value)])),
})
if (!response.ok) throw new Error(`QVeris request failed: ${response.status}`)
console.log(await response.json())
import json
import requests
response = requests.request(
"POST",
"https://qveris.ai/api/v1/oauth/token",
data=json.loads(r'''{
"grant_type": "authorization_code",
"code": "YOUR_AUTHORIZATION_CODE",
"redirect_uri": "YOUR_REGISTERED_REDIRECT_URI",
"code_verifier": "YOUR_PKCE_CODE_VERIFIER",
"client_id": "YOUR_CLIENT_ID"
}'''),
timeout=30,
)
response.raise_for_status()
print(response.json())
| Status | Meaning | Schema |
|---|---|---|
200 | Successful Response | OAuthAccessTokenResponse | OAuthTokenExchangeResponse |
400 | OAuth request or grant error | OAuthErrorResponse |
401 | Client authentication or bearer-token error | OAuthErrorResponse |
403 | Subject token has insufficient scope | OAuthErrorResponse |
422 | Validation Error | HTTPValidationError |
{
"access_token": "string",
"token_type": "Bearer",
"expires_in": 1,
"scope": "string",
"resource": "string"
}
POST Discover capabilities · POST Inspect capabilities · POST Probe a capability · POST Call a capability
Was this page helpful?