curl --request POST \
  --url https://api.panoflow.io/v1/oauth/token \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=authorization_code \
  --data code=pfc_Hq2Lx7Rm2Kp9QxT4bN8vL0wZ \
  --data redirect_uri=https://claude.ai/api/mcp/auth_callback \
  --data client_id=cli_01JB8QGXJY8230B0ARNFJD2WEX \
  --data code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk \
  --data resource=https://mcp.panoflow.io

{
  "access_token": "pfa_2Lm9Vx4Qa7Ne1Kp5r8WzT3bQ",
  "token_type": "Bearer",
  "expires_in": 900,
  "refresh_token": "pfr_9Tb3kQ7fQ2mN8xLp4RzW1aQe",
  "scope": "accounts:read transfers:read transfers:write recipients:read",
  "grant_id": "grt_01JB8QGXJY8230B0ARNFJD2WEX",
  "agent_id": "agt_01JBM3Z0EWNVR3DF3V7BYAHAS7"
}

{
  "error": "invalid_request",
  "error_description": "<string>",
  "error_uri": "<string>"
}

{
  "error": "invalid_request",
  "error_description": "<string>",
  "error_uri": "<string>"
}

{
  "error": {
    "response_code": "00",
    "type": "invalid_request",
    "code": "invalid_json",
    "message": "<string>",
    "request_id": "<string>",
    "param": "<string>",
    "doc_url": "<string>",
    "details": {}
  }
}

{
  "error": {
    "response_code": "00",
    "type": "invalid_request",
    "code": "invalid_json",
    "message": "<string>",
    "request_id": "<string>",
    "param": "<string>",
    "doc_url": "<string>",
    "details": {}
  }
}

OAuth

Token endpoint

OAuth 2.1 token endpoint for public clients with PKCE (application/x-www-form-urlencoded). authorization_code exchanges the code from the consent redirect; refresh_token rotates. Access tokens live 15 minutes (expires_in: 900) and are bound to the grant and to resource. A paused agent, a revoked or expired grant, or a reused refresh token → invalid_grant (reuse also revokes the grant). Errors use the RFC 6749 shape.

Error codes: parameter_invalid, parameter_missing, rate_limited.

POST

oauth

token

curl --request POST \
  --url https://api.panoflow.io/v1/oauth/token \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=authorization_code \
  --data code=pfc_Hq2Lx7Rm2Kp9QxT4bN8vL0wZ \
  --data redirect_uri=https://claude.ai/api/mcp/auth_callback \
  --data client_id=cli_01JB8QGXJY8230B0ARNFJD2WEX \
  --data code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk \
  --data resource=https://mcp.panoflow.io

{
  "access_token": "pfa_2Lm9Vx4Qa7Ne1Kp5r8WzT3bQ",
  "token_type": "Bearer",
  "expires_in": 900,
  "refresh_token": "pfr_9Tb3kQ7fQ2mN8xLp4RzW1aQe",
  "scope": "accounts:read transfers:read transfers:write recipients:read",
  "grant_id": "grt_01JB8QGXJY8230B0ARNFJD2WEX",
  "agent_id": "agt_01JBM3Z0EWNVR3DF3V7BYAHAS7"
}

{
  "error": "invalid_request",
  "error_description": "<string>",
  "error_uri": "<string>"
}

{
  "error": "invalid_request",
  "error_description": "<string>",
  "error_uri": "<string>"
}

{
  "error": {
    "response_code": "00",
    "type": "invalid_request",
    "code": "invalid_json",
    "message": "<string>",
    "request_id": "<string>",
    "param": "<string>",
    "doc_url": "<string>",
    "details": {}
  }
}

{
  "error": {
    "response_code": "00",
    "type": "invalid_request",
    "code": "invalid_json",
    "message": "<string>",
    "request_id": "<string>",
    "param": "<string>",
    "doc_url": "<string>",
    "details": {}
  }
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Headers

X-Request-Id

string

Optional client correlation id, up to 128 characters. It is not echoed: the response's X-Request-Id is always our own req_… id. We log your value with the request as client_request_id, so support can find a request by either id. A longer value is refused with 400 parameter_invalid.

Maximum string length: 128

Body

application/x-www-form-urlencoded

Option 1
Option 2

Form-encoded token request.

grant_type

string

required

authorization_code.

Allowed value: "authorization_code"

code

string

required

Code from the redirect. Single use; 60 seconds. Reuse revokes the grant.

redirect_uri

string<uri>

required

Same value as in the authorization request.

client_id

string

required

Client id.

Pattern: ^cli_[0-9A-HJKMNP-TV-Z]{26}$

code_verifier

string

required

PKCE verifier, 43–128 chars.

Required string length: 43 - 128

resource

string<uri>

RFC 8707; must match the authorization request.

Response

Tokens.

RFC 6749 §5.1 token response, plus PanoFlow extensions.

access_token

string

required

Opaque bearer token for resource. 15 minutes.

token_type

string

required

Always Bearer.

Allowed value: "Bearer"

expires_in

integer

required

Seconds; always 900.

refresh_token

string

required

New rotating refresh token, bound to the grant.

scope

string

required

Space-separated effective scopes.

grant_id

string

PanoFlow extension: the grant.

Pattern: ^grt_[0-9A-HJKMNP-TV-Z]{26}$

agent_id

string

PanoFlow extension: the agent the token acts as.

Pattern: ^agt_[0-9A-HJKMNP-TV-Z]{26}$

Accounts & transactions

Payments

Collections

Payroll

Approvals

Webhooks & events

OAuth

Token endpoint

Authorizations

Headers

Body

Response