Skip to main content

​
Endpoint

POST https://auth.planetscale.com/oauth/token
This is the standard OAuth 2.0 token endpoint for creating and refreshing access tokens.

​
Request Body

The request body should be sent as application/x-www-form-urlencoded.

​
For authorization code exchange

​
grant_type
string
required
Must be authorization_code
​
code
string
required
The authorization code received from the authorization flow
​
redirect_uri
string
required
The redirect URI used in the authorization request
​
client_id
string
required
Your OAuth application’s client ID
​
client_secret
string
required
Your OAuth application’s client secret

​
For token refresh

​
grant_type
string
required
Must be refresh_token
​
refresh_token
string
required
The refresh token from a previous token response
​
client_id
string
required
Your OAuth application’s client ID
​
client_secret
string
required
Your OAuth application’s client secret

​
Response

​
Success Response (200 OK)

{
  "access_token": "pscale_oauth_8zO_rNQCct1Uj8zkTWLh3kgwAqg8UabGIc43D2eINvo",
  "token_type": "Bearer",
  "expires_in": 2592000,
  "refresh_token": "pscale_oauth_refresh_W_zjmZ1a14sczj15bxJdsW_kiv063OrHG4CBh0IXR9M",
  "scope": "read_user read_databases"
}
​
access_token
string
The OAuth access token to use for API requests
​
token_type
string
Will always be “Bearer”
​
expires_in
integer
Number of seconds until the access token expires
​
refresh_token
string
Token to use for refreshing the access token when it expires
​
scope
string
Space-separated list of scopes granted to this token

​
Example

# Exchange authorization code for access token
curl -X POST https://auth.planetscale.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=YOUR_AUTHORIZATION_CODE" \
  -d "redirect_uri=https://your-app.com/callback" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET"

# Refresh an access token
curl -X POST https://auth.planetscale.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token" \
  -d "refresh_token=YOUR_REFRESH_TOKEN" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET"

​
Error Responses

​
400 Bad Request

Invalid request parameters (e.g., missing required fields, invalid grant_type).

​
401 Unauthorized

Invalid client credentials (client_id or client_secret is incorrect).

​
400 Invalid Grant

The authorization code or refresh token is invalid, expired, or already used.