Exchange a code, device_code, or refresh_token for a credential
One endpoint, three grants. The grant only selects HOW the exchange happens; the credential type is selected by the resource (RFC 8707) and the binding, not the grant: an account_access consent always yields an NVM API key; otherwise a resource matching this API’s host yields an NVM API key and any other resource yields an x402 payment permission; with no resource, a delegation-backed binding yields an x402 permission and a plan-only binding yields an NVM API key. Device-flow polling returns a top-level error: authorization_pending, slow_down (add 5s to your interval), access_denied, expired_token. Honour the interval — this endpoint is rate-limited (~60/min per client IP for device polls, shared across concurrent ceremonies from the same address), so a real HTTP 429 (distinct from the slow_down grant error) is reachable under a tight poll loop.
Body
authorization_code, refresh_token, urn:ietf:params:oauth:grant-type:device_code "authorization_code"
"fleet"
Required for authorization_code.
Required for authorization_code — must match the authorize request.
"cursor://oauth/callback"
PKCE verifier. Required for authorization_code.
"dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
Required for the device_code grant.
Required for refresh_token.
"nvm_rt_Zm9vYmFy…"
RFC 8707 resource (audience). SELECTS the credential type on the authorization_code and device_code exchanges (this API's host → NVM API key; any other → x402 permission). On refresh_token it does NOT select: the credential is re-derived from the binding, and a resource here is only validated against the one bound at authorize (mismatch → BCK.OAUTH.0005) — it cannot re-target the credential.
"https://mcp-server.example.com"
Response
The minted credential
The credential selected by the resource/binding (see the endpoint description), NOT by the grant: an NVM API key (environment-prefixed, e.g. sandbox:… / live:…, as in this example) or an x402 payment permission (a JWT, NOT environment-prefixed).
"sandbox:eyJhbGciOiJFUzI1NksifQ…"
Bearer "Bearer"
3600
"nvm_rt_Zm9vYmFy…"
"openid"
Related topics
API error codesValidate RequestsGuardrails and error codesx402 ProtocolEmbed Nevermined Widgets