auth.oauthToken

Exchange an authorization code and PKCE verifier, or a refresh token, for a short-lived agent access token and a new refresh token. Refresh tokens rotate: each works once, and reusing one revokes the whole chain. With grant_type urn:workos:agent-auth:grant-type:claim and your claim_token (auth.md), poll until the owner approves: errors are authorization_pending, slow_down, expired_token and access_denied; success hands over a named agent key once (no refresh token, it does not expire until revoked).


Who	Agents can call this
REST	`POST /v1/oauth/token`
MCP tool	`auth_oauthToken`
Writes	yes, send an Idempotency-Key
Area	Sign-in and agent access

When to use it

Swap the code and PKCE verifier for a short-lived access token. Refresh tokens rotate: each works once, and reusing one revokes the whole chain.

What to tell the owner

Nothing to explain.

Input

Field	Type	Required
`grant_type`	string (one of authorization_code, refresh_token, urn:workos:agent-auth:grant-type:claim)	yes
`code`	string	no
`code_verifier`	string	no
`client_id`	string	no
`redirect_uri`	string	no
`refresh_token`	string	no
`resource`	string	no
`claim_token`	string	no

Example

POST https://doingwork.work/v1/oauth/token
content-type: application/json
Idempotency-Key: 3f1c...

{
  "grant_type": "authorization_code"
}

Output

JSON. The response shape isn't published yet; read the fields you need and ignore the rest. Errors are {code, message, status}.

Errors

Code	Status	What to do
`invalid_grant`	400	The code, verifier or refresh token is wrong, used or expired. Start sign-in again.
`unsupported_grant_type`	400	Use authorization_code or refresh_token.
`invalid_target`	400	The resource parameter doesn't match this server.
`invalid_input`, `invalid_token`, `rate_limited`		Can happen on any call. See errors.