OAuth tokens

These endpoints implement the token lifecycle for public PKCE clients. Token requests do not use the API /api/v1 prefix.

POST/oauth/token

Exchange an authorization code

Send JSON or form-encoded fields: grant_type=authorization_code, client_id, redirect_uri, code, and the original code_verifier. The redirect URI must exactly match the authorization request and client registration.

{
  "token_type": "Bearer",
  "expires_in": 900,
  "access_token": "...",
  "refresh_token": "..."
}

POST/oauth/token

Refresh an access token

Send grant_type=refresh_token, client_id, and refresh_token. A refresh token expires after 30 days. Persist the newly returned refresh token when one is provided.

{
  "grant_type": "refresh_token",
  "client_id": "YOUR_CLIENT_ID",
  "refresh_token": "STORED_REFRESH_TOKEN"
}

POST/oauth/revoke

Revoke the current token

Authenticate with the access token that should be revoked. A successful revocation returns an empty 200 OK response.

curl -X POST https://{tenant}.alution.cloud/oauth/revoke \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Accept: application/json"

GET/api/v1/auth/user

Get the current user

Returns the authenticated user. Required scope: profile:read.