Generate an OAuth 2.1 authorization code
Authorization Code flow with PKCE (mandatory). Mints an x402 payment permission for a specific agent and plan. Browser-initiated in the signed-in user’s context — authenticated with the user’s Nevermined API key (unauthenticated → BCK.OAUTH.0007). Requires a pre-registered client_id (unregistered → BCK.OAUTH.0016).
Authorizations
A Nevermined API key: Authorization: Bearer <sandbox:… | live:…>. Environment-prefixed, not a bare JWT — send the whole string.
Body
Pre-registered OAuth client (connector).
"fleet"
"cursor://oauth/callback"
PKCE challenge (base64url SHA-256).
"E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"
S256 "S256"
Target agent for the grant. Optional.
"agent-123"
RFC 8707 resource (audience) — SELECTS the credential type: this API's host → NVM API key; any other resource → x402 payment permission. Omit it and the binding decides (delegation-backed → x402 permission; plan-only → NVM API key).
"https://mcp-server.example.com"
CSRF protection.
"xyz"
Plan to authorize against. Optional.
"105906634574379352540220884472"
Account-level (account_access) spend mandate only: the card rail backing the cap. Plan-agnostic card providers only. All five spend-mandate fields are REQUIRED together for an account-level grant (partial presence → BCK.OAUTH.0026); they are ignored for an agent-specific grant.
stripe, braintree, vgs Account-level only: the enrolled card id backing the delegation. Part of the all-or-nothing spend-mandate set (see provider).
Account-level only: cumulative spend cap in cents (smallest currency unit), 1..100000000 ($1,000,000 ceiling). This is where a cap is SET; its consumption surfaces later as AgentBindingSummary.spendingLimitCents / amountSpentCents.
1 <= x <= 1000000005000
Account-level only: the spend cap's active window in seconds, 1..31536000 (1-year ceiling).
1 <= x <= 315360002592000
Account-level only: the fiat currency of the spend cap. Card rails only — crypto codes are rejected.
usd, eur Response
Authorization code
Authorization code to exchange at /oauth/token.
"abc123…"