DevelopersApi referenceAuthentication
Exchange client credentials
POST
/api/v1/auth/token/exchangeExchange credentials provisioned for an integration for a short-lived delegated token. The token is returned only once.
Required access
Credentials: client credentials
The client must be active, the represented user must have granted it access, and requested scopes must be allowed by both.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
Payload for the token exchange endpoint.
Deliberately carries no org_id — the org boundary is derived
from the authenticated client, never from caller input.
Response Body
application/json
application/json
application/json
application/json
application/json
application/json
curl -X POST "https://example.com/api/v1/auth/token/exchange" \ -H "Authorization: Bearer $GUEST_MACHINES_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "client_id": "replace-with-client-id", "client_secret": "replace-with-client-secret", "user_id": "d5cb3572-920f-4e26-8202-4d8c67f12345", "scopes": [ "mcp_servers:list", "mcp_servers:create" ], "expires_in_seconds": 3600 }'{ "delegated_token": { "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08", "oauth_client_id": "727760ca-b97d-449c-90e5-7773c8142d5d", "org_id": "a40f5d1f-d889-42e9-94ea-b9b33585fc6b", "user_id": "a169451c-8525-4352-b8ca-070dd449a1a5", "token_prefix": "string", "scopes": [ "string" ], "status": "active", "expires_at": "2019-08-24T14:15:22Z", "revoked_at": "2019-08-24T14:15:22Z", "last_used_at": "2019-08-24T14:15:22Z", "created_at": "2019-08-24T14:15:22Z" }, "raw_token": "string"}{ "detail": "string", "error_code": "string", "request_id": "string"}{ "detail": "string", "error_code": "string", "request_id": "string"}{ "detail": "string", "error_code": "string", "request_id": "string"}{ "detail": "string", "error_code": "string", "request_id": "string"}{ "detail": "string", "error_code": "string", "request_id": "string"}