Exchange a grant for tokens

The token endpoint (RFC 6749). The public simforge-cli client (its client_id required): the device code grant, authorization_code with PKCE, and rotating refresh_token. An AI agent (auth.md, no client_id): the claim grant urn:workos:agent-auth:grant-type:claim, polling its registration, and the JWT-bearer grant (RFC 7523) re-exchanging the identity assertion the claim grant returned; agents get no refresh token. Unauthenticated by design: each grant is bound by a device code, PKCE, a claim token, an assertion this host signed, or an unspent refresh token. While the person has not approved yet, the device and claim grants answer authorization_pending (or slow_down).

POST /api/cli/token

Exchange a grant for tokens

cURL

curl --request POST \
  --url https://dev.simforge.ai/api/cli/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data client_id=simforge-cli \
  --data grant_type=urn:ietf:params:oauth:grant-type:device_code \
  --data 'device_code=<string>'

200

{
  "access_token": "<string>",
  "token_type": "Bearer",
  "expires_in": 123,
  "refresh_token": "<string>",
  "refresh_expires_in": 123,
  "scope": "<string>",
  "session_id": "<string>",
  "account": {
    "id": "<string>",
    "email": "<string>",
    "name": "<string>"
  },
  "organization": {
    "id": "<string>",
    "name": "<string>",
    "workspace_id": "<string>"
  }
}

Body

application/x-www-form-urlencoded

Option 1

Option 2

Option 3

Option 4

Option 5

client_id · enum<string> · required

Available options: simforge-cli

grant_type · enum<string> · required

Available options: urn:ietf:params:oauth:grant-type:device_code

device_code · string · required

Response

200

application/json

A CLI session's access and refresh tokens; an agent's first access token and identity assertion (claim grant); or a fresh access token (JWT-bearer grant).

Option 1

Option 2

Option 3

access_token · string · required

A sfc_at_… bearer token for /api/v1 and /api/cli.

token_type · enum<string> · required

Available options: Bearer

expires_in · integer · required

refresh_token · string · required

refresh_expires_in · integer · required

scope · string · required

session_id · string · required

account · object · required

Show child attributes

organization · object · required

Show child attributes