Exchange Token
agentAuth
Exchange Token
Exchange an authorization code with its PKCE verifier, or rotate a refresh token. Refresh-token reuse revokes the entire grant.
POST
Exchange Token
Body
application/json
Response
A short-lived access token and a single-use rotating refresh token.
Available options:
Bearer Required range:
x >= 1The first-party client surface that may present the resulting token.
Available options:
cli, mcp Maximum organization role the grant may exercise. Owner grants do not exist.
Available options:
member, admin Exact public API operation ids the grant may call.
Required array length:
1 - 256 elementsMaximum string length:
128Pattern:
^[A-Za-z][A-Za-z0-9]*\.[A-Za-z][A-Za-z0-9]*$