OAuth 2.0 reference

The Gateway is its own authorization server. Its metadata is published at GET /.well-known/oauth-authorization-server.

Property	Value
Issuer	https://api.inside.chat
Grant types	client_credentials, authorization_code, refresh_token
Response types	code
PKCE	S256 only
Client authentication	client_secret_basic only
Client ID	The credential ID
Client secret	The credential’s token

Dynamic client registration and public clients aren’t supported.

POST /oauth/token

Send application/x-www-form-urlencoded fields, with HTTP Basic client authentication.

Grant	Fields
client_credentials	grant_type, optional scope, optional resource
authorization_code	grant_type, code, redirect_uri, code_verifier, resource
refresh_token	grant_type, refresh_token, resource

resource is the audience: https://api.inside.chat for REST, https://api.inside.chat/mcp for MCP, or https://api.inside.chat/a2a for A2A.

{
  "access_token": "igw_live_...",
  "token_type": "Bearer",
  "expires_in": 900,
  "scope": "website_read conversation_read"
}

Authorization code responses can also include refresh_token, starting with igr_live_ or igr_test_, when the person allowed renewal.

GET /oauth/authorize

Starts the authorization code flow. Required parameters: response_type=code, client_id, redirect_uri, resource, scope, state, code_challenge and code_challenge_method=S256.

The callback receives code, state and iss, or error=access_denied.

POST /oauth/revoke

Revokes an access or refresh token. Send the form field token, with HTTP Basic client authentication. The response is 200 whether or not the token exists.

Errors

Token endpoint errors use the standard OAuth JSON shape:

{ "error": "invalid_grant" }

Error	Meaning
invalid_request	A field is missing, duplicated or malformed
invalid_client	Client authentication failed, or the credential is expired or revoked (HTTP 401)
invalid_grant	The code, verifier, redirect URI or refresh token isn’t valid
invalid_scope	A requested scope isn’t held by the credential
invalid_target	The resource isn’t a Gateway resource
unsupported_grant_type	The grant type isn’t supported for this client
temporarily_unavailable	Try again later (HTTP 503)

Above 100 active access tokens per credential, the endpoint returns 429 with Retry-After: 60.