Class OauthResource

constructor

• new OauthResource(http: HttpClient): OauthResource

  Parameters

  • http: HttpClient

  Returns OauthResource

Readonlydevice

scopes

• scopes(): Promise<{ scopes: Record<string, unknown> }>

  List available OAuth scopes Returns the complete set of OAuth scopes that the platform supports. Use this endpoint to discover which scopes are available before constructing an authorization request or rendering a consent UI. No authentication is required. The response is the same for all callers.

  Returns Promise<{ scopes: Record<string, unknown> }>

  Successful response

token

• token(
      input: {
          client?: string;
          code?: string;
          code_verifier?: string;
          device_code?: string;
          grant_type: string;
          redirect_uri?: string;
          refresh_token?: string;
      },
  ): Promise<OAuthTokenResponse>

  Exchange a grant for OAuth tokens Issues an access token and a refresh token in exchange for a valid grant. Three grant types are supported: "authorization_code", "refresh_token", and "urn:ietf:params:oauth:grant-type:device_code". For "authorization_code" grants, supply code, client, redirect_uri, and optionally code_verifier for PKCE flows. Each authorization code is single-use; consuming it a second time returns invalid_grant. For "refresh_token" grants, supply refresh_token. Resource-bound public clients must also supply client. The endpoint rotates the refresh token on every call and returns a fresh pair of tokens. For device-code grants, supply device_code and client. Poll this endpoint after receiving authorization_pending until the user approves or the code expires. Slow down polling if you receive slow_down. This endpoint is rate-limited to 20 requests per IP per 60 seconds. Exceeding the limit returns HTTP 429 with "error": "too_many_requests".

  Parameters

  • input: {
        client?: string;
        code?: string;
        code_verifier?: string;
        device_code?: string;
        grant_type: string;
        redirect_uri?: string;
        refresh_token?: string;
    }

    Request body.

    • Optionalclient?: string

      OAuth client ID identifying the application requesting tokens. Required for "authorization_code", device-code, and resource-bound refresh grants.

    • Optionalcode?: string

      Single-use authorization code issued by the authorization endpoint. Required for "authorization_code" grants.

    • Optionalcode_verifier?: string

      PKCE code verifier corresponding to the code_challenge sent in the authorization request. Required when the authorization code was issued with a code challenge; omit otherwise.

    • Optionaldevice_code?: string

      Device code received from the device authorization endpoint. Required for device-code grants.

    • grant_type: string

      The OAuth 2.0 grant type. One of "authorization_code", "refresh_token", or "urn:ietf:params:oauth:grant-type:device_code".

    • Optionalredirect_uri?: string

      Redirect URI that was used in the original authorization request. Must exactly match the URI on record for the client. Required for "authorization_code" grants.

    • Optionalrefresh_token?: string

      Refresh token received from a previous token response. Required for "refresh_token" grants. The token is rotated on each successful call.

  Returns Promise<OAuthTokenResponse>

  Token pair issued for the authenticated user.