Skip to main content
POST
Exchange a human-approved authorization code, claim or assertion

Body

application/x-www-form-urlencoded
grant_type
any
required
claim_token
string
required

Private claim token returned by registration. Never put it in a URL.

Maximum string length: 100
resource
enum<string>
required
Available options:
https://console.altss.com/v1/console,
https://console.altss.com/v1/console/mcp
code_verifier
string
required
Pattern: ^[A-Za-z0-9._~-]{43,128}$

Response

authorization_code returns OAuthTokenResponse with expires_in and no assertion. The two existing extension grants return TokenResponse without scheduled expiry; only the initial claim exchange includes identity_assertion and assertion_expires. These distinct credential families retain their actual server-enforced limits.

access_token
string
required

Opaque revocable Console credential; not an Auth0 token or a JWT access token.

token_type
any
required
scope
any
required
identity_assertion
string

Returned only by the initial claim exchange.

assertion_expires
string<date-time>

Returned only with identity_assertion.