Skip to main content
POST
Exchange a code, device_code, or refresh_token for a credential

Body

application/json
grant_type
enum<string>
required
Available options:
authorization_code,
refresh_token,
urn:ietf:params:oauth:grant-type:device_code
Example:

"authorization_code"

client_id
string
required
Example:

"fleet"

code
string | null

Required for authorization_code.

redirect_uri
string | null

Required for authorization_code — must match the authorize request.

Example:

"cursor://oauth/callback"

code_verifier
string | null

PKCE verifier. Required for authorization_code.

Example:

"dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"

device_code
string | null

Required for the device_code grant.

refresh_token
string | null

Required for refresh_token.

Example:

"nvm_rt_Zm9vYmFy…"

resource
string | null

RFC 8707 resource (audience). SELECTS the credential type on the authorization_code and device_code exchanges (this API's host → NVM API key; any other → x402 permission). On refresh_token it does NOT select: the credential is re-derived from the binding, and a resource here is only validated against the one bound at authorize (mismatch → BCK.OAUTH.0005) — it cannot re-target the credential.

Example:

"https://mcp-server.example.com"

Response

The minted credential

access_token
string

The credential selected by the resource/binding (see the endpoint description), NOT by the grant: an NVM API key (environment-prefixed, e.g. sandbox:… / live:…, as in this example) or an x402 payment permission (a JWT, NOT environment-prefixed).

Example:

"sandbox:eyJhbGciOiJFUzI1NksifQ…"

token_type
enum<string>
Available options:
Bearer
Example:

"Bearer"

expires_in
integer
Example:

3600

refresh_token
string | null
Example:

"nvm_rt_Zm9vYmFy…"

scope
string | null
Example:

"openid"