Skip to main content
POST https://api.getkato.io/oauth/token Exchange an authorization code or rotate a refresh token for a registered client. See OAuth flow and credentials for client registration, authorization, and token rotation. Accepts JSON or application/x-www-form-urlencoded. No bearer Authorization header or client secret is required. Code exchange validates membership, client, redirect, and PKCE. Refresh rotates the refresh token and revokes previous access tokens for the grant; store both returned tokens atomically and serialize refresh attempts. Refresh does not extend the original refresh expiry.

​
Parameters

​
string
required
authorization_code or refresh_token.
​
string
required
Registered client ID, 1–100 characters.
​
string
Required for authorization_code; 20–300 characters, unused and unexpired.
​
string
Required for authorization_code; 43–128 characters matching the original S256 challenge.
​
string
Required for authorization_code; exact original allowed URL, up to 1,000 characters.
​
string
Required for refresh_token; current token, 20–300 characters.

​
Response

200 — Top-level access_token, token_type, expires_in (seconds), refresh_token, refresh_token_expires_in (remaining seconds), and space-delimited scope. Responses set Cache-Control: no-store.
200
Request

​
Compatibility alias

POST /oauth/raycast/token calls the same handler. Use /oauth/token for new clients.

​
Authorization-code exchange

Errors use error and error_description: invalid_request, invalid_client, invalid_grant, or unsupported_grant_type. Invalid, expired, reused codes or refresh tokens require recovery through the authorization flow when no current credential remains.