Token endpoint (authorization_code + PKCE)

Mandatory exact resource/client/redirect and S256 verifier; single-use one-minute authorization code. Returns ten-minute ES256 resource JWT, actor_type agent or owner, scope agentsub:agent or agentsub:owner. Human resource tokens recheck current backend Clerk verified-human identity before owner controls. No refresh tokens.

POST/oauth/token

Request body

requiredapplication/x-www-form-urlencoded

grant_typestringrequired

codestringrequired

client_idstringrequired

redirect_uristring<uri>required

code_verifierstringrequired

matches ^[A-Za-z0-9._~-]{43,128}$

resourcestringrequired

Responses

200

Access token issued

access_tokenstring

token_typestring

expires_ininteger

scopestring

Allowed:agentsub:agentagentsub:owner

400

OAuth error JSON (invalid_request, invalid_client, invalid_grant, invalid_scope, invalid_target, invalid_redirect_uri, invalid_client_metadata, unsupported_grant_type)

errorstringrequired

Allowed:invalid_requestinvalid_clientinvalid_grantinvalid_scopeinvalid_targetinvalid_redirect_uriinvalid_client_metadataunsupported_grant_typeaccess_deniedtemporarily_unavailable

error_descriptionstringrequired

415

OAuth error JSON (invalid_request, invalid_client, invalid_grant, invalid_scope, invalid_target, invalid_redirect_uri, invalid_client_metadata, unsupported_grant_type)

errorstringrequired

Allowed:invalid_requestinvalid_clientinvalid_grantinvalid_scopeinvalid_targetinvalid_redirect_uriinvalid_client_metadataunsupported_grant_typeaccess_deniedtemporarily_unavailable

error_descriptionstringrequired

503

OAuth error JSON (temporarily_unavailable — credentials or storage not configured)

errorstringrequired

Allowed:invalid_requestinvalid_clientinvalid_grantinvalid_scopeinvalid_targetinvalid_redirect_uriinvalid_client_metadataunsupported_grant_typeaccess_deniedtemporarily_unavailable

error_descriptionstringrequired

Request

curl -X POST 'https://api.agentsub.dev/oauth/token' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'grant_type=authorization_code&code=string&client_id=string&redirect_uri=http%3A%2F%2Fexample.com&code_verifier=string&resource=string'

const response = await fetch("https://api.agentsub.dev/oauth/token", {
  method: "POST",
  headers: {
    "Accept": "application/json",
    "Content-Type": "application/x-www-form-urlencoded"
  },
  body: "grant_type=authorization_code&code=string&client_id=string&redirect_uri=http%3A%2F%2Fexample.com&code_verifier=string&resource=string"
});

import requests

response = requests.post(
    "https://api.agentsub.dev/oauth/token",
    headers={
        "Accept": "application/json",
        "Content-Type": "application/x-www-form-urlencoded"
    },
    data="grant_type=authorization_code&code=string&client_id=string&redirect_uri=http%3A%2F%2Fexample.com&code_verifier=string&resource=string",
)

Response

{
  "access_token": "string",
  "token_type": "Bearer",
  "expires_in": 600,
  "scope": "agentsub:agent"
}

{
  "error": "invalid_request",
  "error_description": "string"
}

{
  "error": "invalid_request",
  "error_description": "string"
}

{
  "error": "invalid_request",
  "error_description": "string"
}