OAuth token endpoint

POST

/oauth/token

curl --request POST \
  --url https://api.deploybase.eu/api/v1/oauth/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=example \
  --data client_id=example

Exchanges an authorization code (with PKCE) or a refresh token for an access token (dba_, 1 hour, audience = the MCP server) and a rotating refresh token (dbr_, 30 days). Public clients only: client_secret and HTTP Basic are refused with invalid_client. Errors are RFC 6749 JSON, not the API envelope.

Parameters

FormData Parameters

grant_type

required

string

Authorization_code or refresh_token

client_id

required

string

Client id

code

string

Authorization code

redirect_uri

string

Redirect URI of the authorization request

code_verifier

string

PKCE verifier

refresh_token

string

Refresh token

resource

string

The MCP server resource URL

Responses

200

OK

Media type application/json

object

access_token

string

expires_in

integer

refresh_token

string

scope

string

token_type

string

Example ^generated

{
  "access_token": "example",
  "expires_in": 1,
  "refresh_token": "example",
  "scope": "example",
  "token_type": "example"
}

400

Bad Request

Media type application/json

object

error

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

401

Unauthorized

Media type application/json

object

error

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}

500

Internal Server Error

Media type application/json

object

error

string

error_description

string

Example ^generated

{
  "error": "example",
  "error_description": "example"
}