Endpoint
POST https://auth.planetscale.com/oauth/token
Request Body
The request body should be sent as application/x-www-form-urlencoded.
For authorization code exchange
Must be authorization_code
The authorization code received from the authorization flow
The redirect URI used in the authorization request
Your OAuth application’s client ID
Your OAuth application’s client secret
For token refresh
The refresh token from a previous token response
Your OAuth application’s client ID
Your OAuth application’s client secret
Response
Success Response (200 OK)
{
"access_token": "pscale_oauth_8zO_rNQCct1Uj8zkTWLh3kgwAqg8UabGIc43D2eINvo",
"token_type": "Bearer",
"expires_in": 2592000,
"refresh_token": "pscale_oauth_refresh_W_zjmZ1a14sczj15bxJdsW_kiv063OrHG4CBh0IXR9M",
"scope": "read_user read_databases"
}
The OAuth access token to use for API requests
Number of seconds until the access token expires
Token to use for refreshing the access token when it expires
Space-separated list of scopes granted to this token
Example
# Exchange authorization code for access token
curl -X POST https://auth.planetscale.com/oauth/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=authorization_code" \
-d "code=YOUR_AUTHORIZATION_CODE" \
-d "redirect_uri=https://your-app.com/callback" \
-d "client_id=YOUR_CLIENT_ID" \
-d "client_secret=YOUR_CLIENT_SECRET"
# Refresh an access token
curl -X POST https://auth.planetscale.com/oauth/token \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=refresh_token" \
-d "refresh_token=YOUR_REFRESH_TOKEN" \
-d "client_id=YOUR_CLIENT_ID" \
-d "client_secret=YOUR_CLIENT_SECRET"
Error Responses
400 Bad Request
Invalid request parameters (e.g., missing required fields, invalid grant_type).
401 Unauthorized
Invalid client credentials (client_id or client_secret is incorrect).
400 Invalid Grant
The authorization code or refresh token is invalid, expired, or already used.
