Saltar al contenido principal

Exchange a loopback code + PKCE verifier for a client token

POST 
/auth/cli/token

Body (JSON or form): code, code_verifier, client_id, redirect_uri, optional state. Returns the personal API token (90-day default, 365 max) once. A wrong verifier, a reused or expired code, another client or redirect: 400 invalid_grant, and the code is burned. No authentication header; rate limited per IP.

Responses​

Successful Response