API Reference
OAuth

Token endpoint

POST
/oauth/token

RFC 6749 §3.2. Exchanges an authorization code (with PKCE verifier) or a refresh token.

Response Body

application/json

application/json

curl -X POST "https://example.com/oauth/token"
{}
{  "error": {    "code": "validation.bad_request",    "message": "string",    "request_id": "string",    "details": [      "string"    ]  }}

Authorization endpoint GET

RFC 6749 §4.1 with PKCE. Redirects the browser to the Sautikit consent screen, which drives `GET /v1/oauth/authorization/{req}` and `POST /v1/oauth/authorization/{req}/decision` behind the session cookie. Deliberately not rate-limited: legitimate clients re-authorize.

Token revocation endpoint POST

RFC 7009. Always 200, whether or not the token existed.