> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prelude.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Token request

> Exchange an authorization `code` (with its PKCE `code_verifier`) for
tokens, or rotate a session with `grant_type=refresh_token`
(RFC 6749 §4.1.3 and §6). Public client — no client authentication
(`token_endpoint_auth_method` is `none`). The request body is
`application/x-www-form-urlencoded`.




## OpenAPI

````yaml post /v1/session/oauth/token
openapi: 3.1.1
info:
  title: Prelude Auth Frontend API
  version: 0.0.1
  description: The Prelude Frontend API for Authentication and Session Management
  contact:
    email: support@prelude.so
servers:
  - url: https://{appId}.session.prelude.dev
    description: Production server
    variables:
      appId:
        default: changeme
        description: The appID
security: []
tags:
  - name: Login OTP
    description: Login and step-up via OTP (phone or email)
  - name: Login Email Password
    description: Login via email and password
  - name: Login OAuth
    description: Login via OAuth providers
  - name: Login SAML
    description: Login via SAML 2.0 SSO connections (Okta, Google Workspace)
  - name: Login Finalize
    description: Finalize a login flow and create a session
  - name: Login Migration
    description: Migrate sessions from a legacy authentication system
  - name: Session
    description: Session refresh and revocation
  - name: Session Management
    description: Authenticated session and identifier management
  - name: Step-Up
    description: Step-up authentication flow
  - name: Well-Known
    description: Public key and authorization-server discovery endpoints
  - name: OAuth Server
    description: >-
      OAuth 2.0 authorization-server endpoints that let MCP clients and other
      third-party apps sign your users in
  - name: Password
    description: Password compliancy and change password
  - name: Passkey Login
    description: >-
      Primary-factor (passwordless) sign-in via WebAuthn discoverable
      credentials
  - name: Passkey Management
    description: >-
      Register / list / rename / delete the authenticated user's passkey
      credentials
paths:
  /v1/session/oauth/token:
    post:
      tags:
        - OAuth Server
      summary: Token request
      description: |
        Exchange an authorization `code` (with its PKCE `code_verifier`) for
        tokens, or rotate a session with `grant_type=refresh_token`
        (RFC 6749 §4.1.3 and §6). Public client — no client authentication
        (`token_endpoint_auth_method` is `none`). The request body is
        `application/x-www-form-urlencoded`.
      operationId: oauthToken
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/OAuthTokenRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthTokenResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
        '500':
          description: Internal Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthError'
      security: []
components:
  schemas:
    OAuthTokenRequest:
      type: object
      description: |
        Form-encoded token request. Send `grant_type=authorization_code` with
        `code`, `client_id`, `redirect_uri`, and `code_verifier`; or
        `grant_type=refresh_token` with `refresh_token`.
      properties:
        grant_type:
          type: string
          enum:
            - authorization_code
            - refresh_token
          examples:
            - authorization_code
        code:
          type: string
          description: The authorization code (for `authorization_code`).
        client_id:
          type: string
          description: The client identifier (for `authorization_code`).
          examples:
            - oac_01jqebhswje1ka1z7ahr9rfsgt
        redirect_uri:
          type: string
          description: >-
            Must match the `redirect_uri` used at `/authorize` (for
            `authorization_code`).
          examples:
            - https://mcp.example.com/oauth/callback
        code_verifier:
          type: string
          description: >-
            PKCE code verifier matching the `code_challenge` (for
            `authorization_code`).
        refresh_token:
          type: string
          description: The refresh token to rotate (for `refresh_token`).
      required:
        - grant_type
    OAuthTokenResponse:
      type: object
      description: RFC 6749 §5.1 access token response.
      properties:
        access_token:
          type: string
          examples:
            - eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9...
        token_type:
          type: string
          examples:
            - Bearer
        expires_in:
          type: integer
          format: int64
          description: Seconds until the access token expires.
          examples:
            - 3600
        refresh_token:
          type: string
        scope:
          type: string
          description: Space-delimited scopes granted to the session.
          examples:
            - mcp:read
      required:
        - access_token
        - token_type
        - expires_in
    OAuthError:
      type: object
      description: RFC 6749 §5.2 / RFC 7591 error response.
      properties:
        error:
          type: string
          examples:
            - invalid_grant
        error_description:
          type: string
      required:
        - error

````