Skip to main content
POST
Generate an OAuth 2.1 authorization code

Authorizations

Authorization
string
header
required

A Nevermined API key: Authorization: Bearer <sandbox:… | live:…>. Environment-prefixed, not a bare JWT — send the whole string.

Body

application/json
client_id
string
required

Pre-registered OAuth client (connector).

Example:

"fleet"

redirect_uri
string
required
Example:

"cursor://oauth/callback"

code_challenge
string
required

PKCE challenge (base64url SHA-256).

Example:

"E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"

code_challenge_method
enum<string>
required
Available options:
S256
Example:

"S256"

agent_id
string | null

Target agent for the grant. Optional.

Example:

"agent-123"

resource
string | null

RFC 8707 resource (audience) — SELECTS the credential type: this API's host → NVM API key; any other resource → x402 payment permission. Omit it and the binding decides (delegation-backed → x402 permission; plan-only → NVM API key).

Example:

"https://mcp-server.example.com"

state
string | null

CSRF protection.

Example:

"xyz"

plan_id
string | null

Plan to authorize against. Optional.

Example:

"105906634574379352540220884472"

provider
enum<string> | null

Account-level (account_access) spend mandate only: the card rail backing the cap. Plan-agnostic card providers only. All five spend-mandate fields are REQUIRED together for an account-level grant (partial presence → BCK.OAUTH.0026); they are ignored for an agent-specific grant.

Available options:
stripe,
braintree,
vgs
provider_payment_method_id
string | null

Account-level only: the enrolled card id backing the delegation. Part of the all-or-nothing spend-mandate set (see provider).

spending_limit_cents
integer | null

Account-level only: cumulative spend cap in cents (smallest currency unit), 1..100000000 ($1,000,000 ceiling). This is where a cap is SET; its consumption surfaces later as AgentBindingSummary.spendingLimitCents / amountSpentCents.

Required range: 1 <= x <= 100000000
Example:

5000

duration_secs
integer | null

Account-level only: the spend cap's active window in seconds, 1..31536000 (1-year ceiling).

Required range: 1 <= x <= 31536000
Example:

2592000

currency
enum<string> | null

Account-level only: the fiat currency of the spend cap. Card rails only — crypto codes are rejected.

Available options:
usd,
eur

Response

Authorization code

code
string

Authorization code to exchange at /oauth/token.

Example:

"abc123…"