/oauth/token

Token — exchange code + PKCE for a token, or refresh

OAuth 2.1 token endpoint (public client, `token_endpoint_auth_method: none`). `grant_type=authorization_code` exchanges a one-time code + `code_verifier` for `{ access_token (RS256 JWT), token_type: Bearer, expires_in, refresh_token, scope }`. `grant_type=refresh_token` rotates the refresh token (reuse of a rotated token revokes the whole family).

free

Parameters

Name	In	Required	Default	Allowed	Description	Example
grant_type	body	required	—	—	`authorization_code` or `refresh_token`.	authorization_code
code	body	optional	—	—	Authorization code (authorization_code grant).	<one-time code>
code_verifier	body	optional	—	—	PKCE verifier (authorization_code grant).	<pkce verifier>
redirect_uri	body	optional	—	—	Must match the authorize request.	http://127.0.0.1:51000/callback
refresh_token	body	optional	—	—	Refresh token (refresh_token grant).	<refresh token>
client_id	body	required	—	—	Client id.	cursor

Response schema

Field	Type	Nullable	Description
access_token	string	no	The RS256 JWT access token. Present it as `Authorization: Bearer <token>` to call MCP tools. Carries `iss`, `aud` (the canonical resource), `sub` (user uuid), `scope`, `token_use: mcp_access`, and a short `exp`.
token_type	string	no	Always `Bearer`.
expires_in	integer	no	Access-token lifetime in seconds (short-lived, ≤15 min). Refresh before it expires.
refresh_token	string	no	An opaque refresh token. A rotated token is returned on every use (rotation family; reusing a rotated token revokes the whole family). Exchange it via `grant_type=refresh_token` for a new access token.
scope	string	no	The scope granted to the token, as a space-delimited string.

Errors

Status	Label	Description
200	OK	Request succeeded.
400	Bad Request	Invalid query, body, or path parameter.
401	Unauthorized	Missing or invalid Authorization header / api_Token.
402	Payment Required	Insufficient token balance for this call. Top up
429	Too Many Requests	Rate limit exceeded for your tier (see /pricing for tier limits). Tier limits
500	Server Error	Unexpected server-side failure. Retry with backoff; report if persistent.

Code samples

Reveal credentials

curl -X POST "https://api.finradar.ai/oauth/token" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
  "grant_type": "authorization_code",
  "code": "<one-time code>",
  "code_verifier": "<pkce verifier>",
  "redirect_uri": "http://127.0.0.1:51000/callback",
  "refresh_token": "<refresh token>",
  "client_id": "cursor"
}'

Generate an API key in /account/credentials to run live queries (literal YOUR_API_KEY placeholder shown until then).