v2

OpenAPI 3.0.3Proprietary2026-07-263483431.1 MB

OAuth

Exchange or refresh OAuth tokens

No OAuth installation scope. OAuth flow endpoint. Confidential clients authenticate with client_secret_post or HTTP Basic auth. Public client registrations with token_endpoint_auth_method=none omit client_secret and must use PKCE.

post/v3/oauth/token

Request body

grant_type'authorization_code' | 'refresh_token' required

client_idstring required

OAuth application client ID, registered client ID, or HTTPS Client ID Metadata Document URL.

client_secretstring

Required for confidential clients when HTTP Basic auth is not used. Omit for public client registrations using token_endpoint_auth_method=none and for clients using private_key_jwt.

client_assertion_typestring

Required for private_key_jwt; must be urn:ietf:params:oauth:client-assertion-type:jwt-bearer.

client_assertionstring

Signed JWT client assertion required for private_key_jwt.

codestring

Authorization code, required for authorization_code.

redirect_uristring uri

Redirect URI used on the authorization request.

code_verifierstring

PKCE code verifier. Required for public clients and recommended for all authorization-code exchanges.

refresh_tokenstring

Refresh token, required for refresh_token.

resourcestring uri

Optional resource audience. Must match the resource requested during authorization when present. Official Scalev MCP DCR/CIMD clients may omit it when the authorization session is already MCP-bound.

Response

Success

RawObjectResponseBody required

Raw single-resource success payload for v3.