Pistis
API referenceM C P

Exchange a code or a refresh token for tokens

POST
/oauth/token

grant_type=authorization_code (with code, code_verifier, client_id, redirect_uri, resource) or grant_type=refresh_token (with refresh_token, client_id; the refresh token rotates and a reuse revokes the family). Public clients (token_endpoint_auth_method: none).

Request Body

application/x-www-form-urlencoded
  1. body
[key: string]?any

Response Body

Tokens

application/json
  1. response
access_token*string
token_type*unknown
expires_in*integer

Seconds

refresh_token?string

Rotated on each use

scope*string
Example Request
curl -X POST 'http://127.0.0.1:7777/oauth/token' \  -H 'Content-Type: application/x-www-form-urlencoded' \  -d 'grant_type=authorization_code&code=x&code_verifier=x&client_id=https%3A%2F%2Fclient.example%2Fmcp-client.json&redirect_uri=https%3A%2F%2Fclient.example%2Fcallback'
Example Response
{  "access_token": "string",  "token_type": "Bearer",  "expires_in": 0,  "refresh_token": "string",  "scope": "string"}

Begin an authorization (the person's browser) GET

`response_type=code`, `client_id` (an https metadata document URL, or a registered client), `redirect_uri` (registered), `code_challenge` + `code_challenge_method=S256`, `state`, `scope` (`sessions` or `sessions:read`), `resource` (`<publicUrl>/mcp`). Shows a consent page to the signed-in person; sends the browser back with `code`, `state` and `iss`. A client or redirect it can't accept gets a page, never a redirect.

Register a client dynamically (RFC 7591) POST

A public client with its redirect URIs, good for thirty days of use. Clients with a metadata document need no registration.