Connections
Trade a code or a refresh token for tokens
Form-encoded.
POST
/oauth/tokenTL;DR
| Question | Answer |
|---|---|
| What does it do? | Trade a code or a refresh token for tokens. |
| What does it take? | Nothing. |
| What does it return? | Status 200 with a body of type TokenAnswer. |
| What can go wrong? | 400 invalid_request, invalid_grant, invalid_scope or unsupported_grant_type; 401 invalid_client; 429 too many requests; 503 sign in with Plotwork is not available on this server (oauth.unavailable). Every failure uses the one error envelope. |
What it does
Form-encoded. authorization_code with the code, the same redirect_uri and the PKCE code_verifier, or refresh_token with the refresh token. A confidential app sends its secret by HTTP Basic or client_secret. The access token works an hour; the refresh token 30 days and once, and one presented again ends the grant. Errors are OAuth's { error, error_description }.
Responses
| Status | Meaning | Body |
|---|---|---|
| 200 | The tokens. | TokenAnswer |
| 400 | invalid_request, invalid_grant, invalid_scope or unsupported_grant_type. | OAuthError |
| 401 | invalid_client. | OAuthError |
| 429 | Too many requests. | ErrorResponse |
| 503 | Sign in with Plotwork is not available on this server (oauth.unavailable). | ErrorResponse |
Response body
A 200 answer has the type TokenAnswer.
| Field | Type | Required | Description |
|---|---|---|---|
access_token | string | yes | pwa_... Send it as Authorization: Bearer. Works for an hour. |
token_type | "Bearer" | yes | |
expires_in | integer | yes | |
refresh_token | string | yes | pwr_... Works once, for 30 days; a refresh answers a new one. |
scope | string | yes |
See also
| Doc | Why |
|---|---|
| API reference | Every endpoint, and the error envelope |
| Schemas | Every request and response type |
| Tool reference | The operations as callable tools |