Skip to main content
POST
/
v1
/
oauth
/
tokens
Generate tokens
curl --request POST \
  --url https://api.hyperline.co/v1/oauth/tokens \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "client_id": "<string>",
  "grant_type": "authorization_code",
  "code": "<string>",
  "redirect_uri": "<string>",
  "client_secret": "<string>",
  "resource": "https://api.hyperline.co/mcp",
  "code_verifier": "<string>"
}
'
{
  "access_token": "<string>",
  "expires_in": 123,
  "token_type": "bearer",
  "refresh_token": "<string>"
}

Authorizations

​
Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Body

application/json
​
client_id
string
required

Application's client ID.

​
grant_type
enum<string>
required

To exchange an auth code for an app access token, use authorization_code.

Available options:
authorization_code
​
code
string
required

The auth code received when creating the authorization.

​
redirect_uri
string
required

Must match the value set at the GET /authorize endpoint.

​
client_secret
string

Application's client secret.

​
resource
string

The canonical URI of the resource server (RFC 8707). For MCP clients, this should be the MCP server endpoint URL. Example: https://api.hyperline.co/mcp

Example:

"https://api.hyperline.co/mcp"

​
code_verifier
string

PKCE code verifier (RFC 7636). The original random string used to generate the code_challenge sent during authorization. Required when code_challenge was used.

Response

200 - application/json
​
access_token
string
required

Access token with which you will be able to access the Hyperline API on the organisation's behalf.

​
expires_in
number
required

The number of seconds left before the app access token expires. Be sure to renew your app access token before this reaches zero.

​
token_type
enum<string>
required
Available options:
bearer
​
refresh_token
string

Refresh token with which you will be able to retrieve a new access token on this endpoint. The refresh token does not expire.