curl --request POST \
--url https://console.altss.com/v1/console/agent-auth/token \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data grant_type=urn:workos:agent-auth:grant-type:claim \
--data 'claim_token=<string>' \
--data 'code_verifier=<string>'import requests
url = "https://console.altss.com/v1/console/agent-auth/token"
payload = {
"grant_type": "urn:workos:agent-auth:grant-type:claim",
"claim_token": "<string>",
"code_verifier": "<string>"
}
headers = {"Content-Type": "application/x-www-form-urlencoded"}
response = requests.post(url, data=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/x-www-form-urlencoded'},
body: new URLSearchParams({
grant_type: 'urn:workos:agent-auth:grant-type:claim',
claim_token: '<string>',
code_verifier: '<string>'
})
};
fetch('https://console.altss.com/v1/console/agent-auth/token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://console.altss.com/v1/console/agent-auth/token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "grant_type=urn%3Aworkos%3Aagent-auth%3Agrant-type%3Aclaim&claim_token=%3Cstring%3E&code_verifier=%3Cstring%3E",
CURLOPT_HTTPHEADER => [
"Content-Type: application/x-www-form-urlencoded"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://console.altss.com/v1/console/agent-auth/token"
payload := strings.NewReader("grant_type=urn%3Aworkos%3Aagent-auth%3Agrant-type%3Aclaim&claim_token=%3Cstring%3E&code_verifier=%3Cstring%3E")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://console.altss.com/v1/console/agent-auth/token")
.header("Content-Type", "application/x-www-form-urlencoded")
.body("grant_type=urn%3Aworkos%3Aagent-auth%3Agrant-type%3Aclaim&claim_token=%3Cstring%3E&code_verifier=%3Cstring%3E")
.asString();require 'uri'
require 'net/http'
url = URI("https://console.altss.com/v1/console/agent-auth/token")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/x-www-form-urlencoded'
request.body = "grant_type=urn%3Aworkos%3Aagent-auth%3Agrant-type%3Aclaim&claim_token=%3Cstring%3E&code_verifier=%3Cstring%3E"
response = http.request(request)
puts response.read_body{
"access_token": "<string>",
"token_type": "Bearer",
"scope": "company.read",
"identity_assertion": "<string>",
"assertion_expires": "2023-11-07T05:31:56Z"
}{
"error": "<string>"
}Exchange an approved claim or one-time assertion
Only the two declared extension grants are implemented. Claim exchange requires actual human approval and the original S256 verifier. Selecting the exact MCP resource requires approved MCP and restricts the key to MCP; selecting the API resource preserves approved channels. The selected resource is immutable across rotation. The Console-issued JWT assertion may rotate the same principal once during the original two-minute approval window and returns no replacement assertion. No authorization_code, client_credentials, refresh_token, RFC8628 device grant, external ID-JAG or generic OAuth client-registration flow is implemented.
curl --request POST \
--url https://console.altss.com/v1/console/agent-auth/token \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data grant_type=urn:workos:agent-auth:grant-type:claim \
--data 'claim_token=<string>' \
--data 'code_verifier=<string>'import requests
url = "https://console.altss.com/v1/console/agent-auth/token"
payload = {
"grant_type": "urn:workos:agent-auth:grant-type:claim",
"claim_token": "<string>",
"code_verifier": "<string>"
}
headers = {"Content-Type": "application/x-www-form-urlencoded"}
response = requests.post(url, data=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {'Content-Type': 'application/x-www-form-urlencoded'},
body: new URLSearchParams({
grant_type: 'urn:workos:agent-auth:grant-type:claim',
claim_token: '<string>',
code_verifier: '<string>'
})
};
fetch('https://console.altss.com/v1/console/agent-auth/token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://console.altss.com/v1/console/agent-auth/token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "grant_type=urn%3Aworkos%3Aagent-auth%3Agrant-type%3Aclaim&claim_token=%3Cstring%3E&code_verifier=%3Cstring%3E",
CURLOPT_HTTPHEADER => [
"Content-Type: application/x-www-form-urlencoded"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://console.altss.com/v1/console/agent-auth/token"
payload := strings.NewReader("grant_type=urn%3Aworkos%3Aagent-auth%3Agrant-type%3Aclaim&claim_token=%3Cstring%3E&code_verifier=%3Cstring%3E")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://console.altss.com/v1/console/agent-auth/token")
.header("Content-Type", "application/x-www-form-urlencoded")
.body("grant_type=urn%3Aworkos%3Aagent-auth%3Agrant-type%3Aclaim&claim_token=%3Cstring%3E&code_verifier=%3Cstring%3E")
.asString();require 'uri'
require 'net/http'
url = URI("https://console.altss.com/v1/console/agent-auth/token")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Content-Type"] = 'application/x-www-form-urlencoded'
request.body = "grant_type=urn%3Aworkos%3Aagent-auth%3Agrant-type%3Aclaim&claim_token=%3Cstring%3E&code_verifier=%3Cstring%3E"
response = http.request(request)
puts response.read_body{
"access_token": "<string>",
"token_type": "Bearer",
"scope": "company.read",
"identity_assertion": "<string>",
"assertion_expires": "2023-11-07T05:31:56Z"
}{
"error": "<string>"
}Body
- Option 1
- Option 2
Private claim token returned by registration. Never put it in a URL.
100https://console.altss.com/v1/console, https://console.altss.com/v1/console/mcp ^[A-Za-z0-9._~-]{43,128}$Response
Opaque revocable bearer credential. No scheduled token expiry is defined, so expires_in is omitted. Initial claim exchange also returns identity_assertion and assertion_expires; assertion exchange does not.