> ## Documentation Index > Fetch the complete documentation index at: https://docs.altss.com/llms.txt > Use this file to discover all available pages before exploring further. # Exchange a human-approved authorization code, claim or assertion > authorization_code requires the original S256 verifier and the identical client_id, redirect_uri and canonical MCP resource from the approved request. This public client uses token_endpoint_auth_method none; Authorization headers, client_secret and client_assertion are rejected. The single-use code yields an opaque MCP-only credential with a durable expiry of at most one hour. No refresh token or identity assertion is returned and OAuth credential rotation is refused. The two named extension grants retain their existing behavior: claim exchange requires actual human approval and original S256 proof; exact MCP resource selection restricts the credential to MCP while API resource selection preserves approved channels. The selected resource remains immutable across the one-time Console-issued JWT assertion rotation within the original approval window. No client_credentials, refresh_token, RFC8628 device grant, external ID-JAG or dynamic client-registration endpoint is implemented. ## OpenAPI ````yaml /console-openapi.json post /v1/console/agent-auth/token openapi: 3.1.1 info: title: Altss Console machine API version: '2026-11-11' description: >- A separate description of the deployed protected Console REST, MCP and agent-authorization interfaces. The public website and documentation readers remain anonymous and are described separately. company.read is necessary but not sufficient: approved channels, verified tenant admission, current terms, per-tool eligibility, data rights, spending limits, explicit purchase approval and confirmed funding remain enforced. The standard authorization-code flow is limited to the exact protected MCP resource and requires S256 plus a public Client ID Metadata Document. REST retains the existing custom user-claimed/JWT extension grants or manually created credentials. Generic OpenAPI tools may ignore those specification extensions; they do not acquire REST access through the MCP authorization-code flow. x-altss-source-commit: d3e57d85db87165d56106a9a0445b1f9f35bcf3d servers: - url: https://console.altss.com security: [] tags: - name: Console REST - name: Console MCP - name: Console authorization externalDocs: url: https://console.altss.com/auth.md description: Authoritative Console authorization and human-approval guide paths: /v1/console/agent-auth/token: post: tags: - Console authorization summary: Exchange a human-approved authorization code, claim or assertion description: >- authorization_code requires the original S256 verifier and the identical client_id, redirect_uri and canonical MCP resource from the approved request. This public client uses token_endpoint_auth_method none; Authorization headers, client_secret and client_assertion are rejected. The single-use code yields an opaque MCP-only credential with a durable expiry of at most one hour. No refresh token or identity assertion is returned and OAuth credential rotation is refused. The two named extension grants retain their existing behavior: claim exchange requires actual human approval and original S256 proof; exact MCP resource selection restricts the credential to MCP while API resource selection preserves approved channels. The selected resource remains immutable across the one-time Console-issued JWT assertion rotation within the original approval window. No client_credentials, refresh_token, RFC8628 device grant, external ID-JAG or dynamic client-registration endpoint is implemented. operationId: exchangeConsoleAgentGrant requestBody: required: true content: application/x-www-form-urlencoded: schema: oneOf: - $ref: '#/components/schemas/ClaimTokenRequest' - $ref: '#/components/schemas/AssertionTokenRequest' - $ref: '#/components/schemas/AuthorizationCode' responses: '200': description: >- authorization_code returns OAuthTokenResponse with expires_in and no assertion. The two existing extension grants return TokenResponse without scheduled expiry; only the initial claim exchange includes identity_assertion and assertion_expires. These distinct credential families retain their actual server-enforced limits. content: application/json: schema: oneOf: - $ref: '#/components/schemas/TokenResponse' - $ref: '#/components/schemas/OAuthTokenResponse' '400': description: >- Protocol refusal, including invalid_request, invalid_grant, invalid_target, authorization_pending, slow_down or expired_token. content: application/json: schema: type: object properties: error: type: string required: - error additionalProperties: false '403': description: Human or organization authority denied. '429': description: Rate limit exceeded. '503': description: >- Temporarily unavailable; token issuance cannot be replayed safely after an uncertain response. security: [] components: schemas: ClaimTokenRequest: type: object properties: grant_type: const: urn:workos:agent-auth:grant-type:claim claim_token: type: string maxLength: 100 description: Private claim token returned by registration. Never put it in a URL. resource: type: string enum: - https://console.altss.com/v1/console - https://console.altss.com/v1/console/mcp code_verifier: type: string pattern: ^[A-Za-z0-9._~-]{43,128}$ required: - grant_type - claim_token - resource - code_verifier additionalProperties: false AssertionTokenRequest: type: object properties: grant_type: const: urn:ietf:params:oauth:grant-type:jwt-bearer assertion: type: string maxLength: 4096 description: >- Only the short-lived assertion issued by this Console is accepted, once, during the original approval window. Its audience is the authorization-server issuer; its separate resource claim is immutable. resource: type: string enum: - https://console.altss.com/v1/console - https://console.altss.com/v1/console/mcp code_verifier: type: string pattern: ^[A-Za-z0-9._~-]{43,128}$ required: - grant_type - assertion - resource - code_verifier additionalProperties: false AuthorizationCode: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: grant_type: type: string const: authorization_code code: type: string pattern: ^oac_[a-f0-9-]{36}\.[A-Za-z0-9_-]{43}$ client_id: type: string minLength: 1 maxLength: 2048 description: >- Exact HTTPS Client ID Metadata Document URL, with a non-root path and no query, fragment, userinfo or dot segments. The document client_id must equal this string. No normalization or pre-registration is performed. The public client must support token_endpoint_auth_method none. redirect_uri: type: string minLength: 1 maxLength: 2048 description: >- Exact registered same-origin HTTPS callback, or registered numeric HTTP loopback 127.0.0.1/[::1] callback with only its port allowed to vary. Must equal the approved redirect_uri at token exchange. resource: type: string minLength: 1 maxLength: 2048 const: https://console.altss.com/v1/console/mcp description: >- Mandatory exact canonical MCP resource. No API, other path, query or fragment is accepted. code_verifier: type: string pattern: ^[A-Za-z0-9._~-]{43,128}$ required: - grant_type - code - client_id - redirect_uri - resource - code_verifier additionalProperties: false description: >- Source-derived strict request. The server additionally rejects control bytes and performs exact client metadata, redirect, resource and proof checks. These semantic checks are not completely expressible in JSON Schema. TokenResponse: type: object properties: access_token: type: string description: >- Opaque revocable Console credential; not an Auth0 token or a JWT access token. token_type: const: Bearer scope: const: company.read identity_assertion: type: string description: Returned only by the initial claim exchange. assertion_expires: type: string format: date-time description: Returned only with identity_assertion. required: - access_token - token_type - scope additionalProperties: false OAuthTokenResponse: type: object properties: access_token: type: string pattern: ^altss_oauth_ description: >- Opaque client-bound and resource-bound MCP credential. Not a JWT or an Auth0 account token. The server enforces the durable expiry and consent limits on every authentication. token_type: const: Bearer scope: const: company.read expires_in: type: integer minimum: 1 maximum: 3600 description: >- Remaining lifetime in seconds, at most one hour. No refresh token, identity assertion or rotation is provided. required: - access_token - token_type - scope - expires_in additionalProperties: false ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.