POST
/api/agents/connect/tokenno authExchange an authorization code
The second half of an authorization-code flow with PKCE. Your app sends the user to the agent, gets a code back, and exchanges it here for a token.
Try it
curl -X POST "https://storkie.ai/api/agents/connect/token" \
-H "Content-Type: application/json" \
-d '{"agentId":"…","code":"…","code_verifier":"…","redirect_uri":"https://your.app/callback"}'No Run button: every call bills the agent’s owner, and a button on a public page would let anyone spend a stranger’s credits.
Request body
| Name | Type | Description |
|---|---|---|
agentIdrequired | string | The agent that issued the code. |
coderequired | string | The authorization code. Single use, short-lived. |
code_verifierrequired | string | The PKCE verifier for the challenge you sent. |
redirect_urirequired | string | Must equal the one used to obtain the code. |
Response
| Name | Type | Description |
|---|---|---|
access_tokenrequired | string | A token scoped to this agent. |
token_typerequired | string | `Bearer`. |
Worth knowing
- PKCE is required and only S256 is accepted. `plain` is refused outright rather than supported for compatibility.
- Redirect URIs are compared by EXACT host equality — never prefix or suffix. That is the check that stops `evil-storkie.ai` being accepted for `storkie.ai`.
Rate limit
By IP; fails closed if the limiter is unavailable
Errors
400— Missing fields, a bad verifier, or a redirect URI that does not match.401— Unknown, expired or already-used code.
Questions
Is a client secret required?
No. PKCE replaces it, which is what makes this safe from a public client like a mobile app or SPA.
How long is a code valid?
Long enough for one redirect and no longer. It is single-use — a replayed code is rejected.