Exchange or refresh OAuth tokens

post

https://api.scalev.com/v3/oauth/token

No OAuth installation scope. OAuth flow endpoint. Confidential clients authenticate with client_secret_post or HTTP Basic auth. Public client registrations with token_endpoint_auth_method=none omit client_secret and must use PKCE.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Body Params

grant_type

string

enum

required

Allowed:

client_id

string

required

OAuth application client ID, registered client ID, or HTTPS Client ID Metadata Document URL.

client_secret

string

Required for confidential clients when HTTP Basic auth is not used. Omit for public client registrations using token_endpoint_auth_method=none and for clients using private_key_jwt.

client_assertion_type

string

Required for private_key_jwt; must be urn:ietf:params:oauth:client-assertion-type:jwt-bearer.

client_assertion

string

Signed JWT client assertion required for private_key_jwt.

code

string

Authorization code, required for authorization_code.

redirect_uri

uri

Redirect URI used on the authorization request.

code_verifier

string

PKCE code verifier. Required for public clients and recommended for all authorization-code exchanges.

refresh_token

string

Refresh token, required for refresh_token.

resource

uri

Optional resource audience. Must match the resource requested during authorization when present. Official Scalev MCP DCR/CIMD clients may omit it when the authorization session is already MCP-bound.

Responses

200Success

400Bad Request