`POST /oauth/token`

OAuth uses S256 PKCE, an exact redirect URI and a separate resource for REST or MCP. Consent is completed in Tong. Refresh tokens rotate on every use.

Request example#

curl -X POST 'https://platform.tongai.io/oauth/token' \  -H "Content-Type: application/x-www-form-urlencoded" \  --data-urlencode 'grant_type=refresh_token' \  --data-urlencode 'refresh_token=YOUR_REFRESH_TOKEN' \  --data-urlencode 'client_id=https://your-app.example/oauth-client.json' \  --data-urlencode 'resource=https://platform.tongai.io/mcp'

Configuration

curl --version

Authentication#

none

Parameters#

No parameters are required.

Request body#

application/x-www-form-urlencoded

object

Response schema#

Response

JSON

{  "access_token": "YOUR_ACCESS_TOKEN",  "token_type": "Bearer",  "expires_in": 300,  "refresh_token": "YOUR_REFRESH_TOKEN",  "scope": "catalog:read operations:read"}

Errors and limits#

Response

JSON

{  "error": "invalid_request"}

AuthenticationAPI keys charge the account that owns the key. OAuth lets each connected user use their own credits.Errors and rate limitsUnderstand error responses, retry safely and recover from failed generations.Requests and logsAn accepted request is not a finished generation. Track the saved job until its output is ready.