OAuth token
curl --request POST \
--url https://chatatp-agent-builder-backend.onrender.com/oauth/token/ \
--header 'Authorization: Bearer <token>'const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://chatatp-agent-builder-backend.onrender.com/oauth/token/', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://chatatp-agent-builder-backend.onrender.com/oauth/token/"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)OAuth 2.1
OAuth token
Exchange authorization codes and rotate refresh tokens
POST
/
oauth
/
token
/
OAuth token
curl --request POST \
--url https://chatatp-agent-builder-backend.onrender.com/oauth/token/ \
--header 'Authorization: Bearer <token>'const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://chatatp-agent-builder-backend.onrender.com/oauth/token/', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://chatatp-agent-builder-backend.onrender.com/oauth/token/"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)Exchange the single-use authorization code returned to your redirect URI. Send OAuth token requests as
Confidential clients must also send
Refresh tokens rotate. Store the new
application/x-www-form-urlencoded.
Authorization code exchange
cURL
curl -X POST https://chatatp-agent-builder-backend.onrender.com/oauth/token/ \
-H "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode "grant_type=authorization_code" \
--data-urlencode "client_id=$CHATATP_CLIENT_ID" \
--data-urlencode "code=$CODE" \
--data-urlencode "redirect_uri=https://your-app.example.com/oauth/callback" \
--data-urlencode "code_verifier=$CODE_VERIFIER"
client_secret. Public clients authenticate with PKCE instead.
Refresh
cURL
curl -X POST https://chatatp-agent-builder-backend.onrender.com/oauth/token/ \
-H "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode "grant_type=refresh_token" \
--data-urlencode "client_id=$CHATATP_CLIENT_ID" \
--data-urlencode "refresh_token=$CHATATP_REFRESH_TOKEN"
refresh_token and discard the previous one.
Response
{
"access_token": "cat_access_...",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": "cat_refresh_...",
"scope": "agents:read messages:send"
}
Using the access token:Include the returned
access_token in the Authorization header as a Bearer token on all subsequent Developer API requests:Authorization: Bearer cat_access_...