Skip to main content
POST
Exchange Token

Body

application/json
grantType
enum<string>
required
Available options:
authorization_code,
refresh_token
clientId
enum<string>
required
Available options:
korve-cli,
korve-mcp
redirectUri
string<uri>
Maximum string length: 2048
code
string
codeVerifier
string
Required string length: 43 - 128
refreshToken
string

Response

A short-lived access token and a single-use rotating refresh token.

tokenType
enum<string>
required
Available options:
Bearer
accessToken
string
required
expiresIn
integer
required
Required range: x >= 1
refreshToken
string
required
refreshExpiresAt
string<date-time>
required
audience
enum<string>
required

The first-party client surface that may present the resulting token.

Available options:
cli,
mcp
role
enum<string>
required

Maximum organization role the grant may exercise. Owner grants do not exist.

Available options:
member,
admin
scopes
string[]
required

Exact public API operation ids the grant may call.

Required array length: 1 - 256 elements
Maximum string length: 128
Pattern: ^[A-Za-z][A-Za-z0-9]*\.[A-Za-z][A-Za-z0-9]*$
organizationId
string<uuid>
required
grantId
string<uuid>
required