> ## Documentation Index
> Fetch the complete documentation index at: https://docs.korve.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange Token

> Exchange an authorization code with its PKCE verifier, or rotate a refresh token. Refresh-token reuse revokes the entire grant.



## OpenAPI

````yaml /openapi.json post /v1/agent-auth/token
openapi: 3.1.0
info:
  title: Korve API
  version: 0.1.0
  description: >-
    Typed control plane for deploying applications and explicitly provisioning
    their managed infrastructure.
servers:
  - url: https://api.korve.dev
security: []
paths:
  /v1/agent-auth/token:
    post:
      tags:
        - agentAuth
      summary: Exchange Token
      description: >-
        Exchange an authorization code with its PKCE verifier, or rotate a
        refresh token. Refresh-token reuse revokes the entire grant.
      operationId: agentAuth.exchangeToken
      parameters: []
      requestBody:
        required: true
        x-korve-max-bytes: 1048576
        content:
          application/json:
            schema:
              type: object
              properties:
                grantType:
                  type: string
                  enum:
                    - authorization_code
                    - refresh_token
                clientId:
                  type: string
                  enum:
                    - korve-cli
                    - korve-mcp
                redirectUri:
                  type: string
                  format: uri
                  maxLength: 2048
                code:
                  type: string
                codeVerifier:
                  type: string
                  minLength: 43
                  maxLength: 128
                refreshToken:
                  type: string
              required:
                - grantType
                - clientId
      responses:
        '200':
          description: A short-lived access token and a single-use rotating refresh token.
          content:
            application/json:
              schema:
                type: object
                properties:
                  tokenType:
                    type: string
                    enum:
                      - Bearer
                  accessToken:
                    type: string
                  expiresIn:
                    type: integer
                    minimum: 1
                  refreshToken:
                    type: string
                  refreshExpiresAt:
                    type: string
                    format: date-time
                  audience:
                    type: string
                    enum:
                      - cli
                      - mcp
                    description: >-
                      The first-party client surface that may present the
                      resulting token.
                  role:
                    type: string
                    enum:
                      - member
                      - admin
                    description: >-
                      Maximum organization role the grant may exercise. Owner
                      grants do not exist.
                  scopes:
                    type: array
                    minItems: 1
                    maxItems: 256
                    items:
                      type: string
                      pattern: ^[A-Za-z][A-Za-z0-9]*\.[A-Za-z][A-Za-z0-9]*$
                      maxLength: 128
                    description: Exact public API operation ids the grant may call.
                  organizationId:
                    type: string
                    format: uuid
                  grantId:
                    type: string
                    format: uuid
                required:
                  - tokenType
                  - accessToken
                  - expiresIn
                  - refreshToken
                  - refreshExpiresAt
                  - audience
                  - role
                  - scopes
                  - organizationId
                  - grantId
        '400':
          description: Invalid, expired, consumed, replayed, or mis-bound grant.
      security: []

````