Get Token

Exchange an approved device code for an access token.

POST https://api.noorle.com/oauth/token
Content-Type: application/json

This endpoint accepts one grant type only: urn:ietf:params:oauth:grant-type:device_code. refresh_token and client_credentials are rejected.

Request

curl -X POST https://api.noorle.com/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "urn:ietf:params:oauth:grant-type:device_code",
    "code": "dc_k3Jd82nfPqW0zXbA7yTvR5mLcH1sGe4U",
    "client_id": "noorle-cli"
  }'

Field	Type	Required	Description
`grant_type`	string	Yes	Must be `urn:ietf:params:oauth:grant-type:device_code`
`code`	string	Yes	The `device_code` from `/oauth/device/authorize`
`client_id`	string	No	Not read by the handler — the token’s audience is taken from the session created at `/oauth/device/authorize`, not from this field. Send the same client id anyway; a mismatch is silently ignored rather than rejected

The field is named code, not device_code. The device-authorize response calls it device_code; the field you send it back in is code. A request with an empty code is rejected as a malformed request.

Response

The token response is returned bare. Unlike the /v1 endpoints, it is not wrapped in a data envelope — read the fields off the top level of the body.

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "..."
}

Field	Type	Description
`access_token`	string	HS256 JWT. Send as `Authorization: Bearer`
`token_type`	string	Always `Bearer`
`expires_in`	integer	3600 — one hour
`scope`	string	Granted scope

The access token’s claims carry iss (the management API host), sub (your user id), aud (a one-element array [client_id], not a bare string), account_id, scope, token_type (always "access_token"), iat, and exp. A successful exchange consumes the device session — the device code is single-use.

There is no refresh flow on this host. api.noorle.com accepts the device-code grant and nothing else, so there is no way to exchange a token for a fresh one. When the hour is up, run the device flow again — or use an API key, which does not expire on a fixed clock.

Polling responses

Poll on the interval returned by /oauth/device/authorize. Five outcomes — still pending, polling too fast, denied, expired, or an unusable code — all come back as the same HTTP 400; only the JSON body’s error field tells them apart.

{
  "error": "authorization_pending",
  "error_description": "The authorization request is still pending."
}

`error`	HTTP	Meaning	What to do
—	200	Approved — token issued	Stop polling
`authorization_pending`	400	Not decided yet	Keep polling at `interval`
`slow_down`	400	Polling too fast	Back off, then keep polling
`access_denied`	400	The human rejected the request	Terminal. Stop polling
`expired_token`	400	The ten-minute window elapsed	Terminal. Start a new device authorization
`invalid_grant`	400	The device code is unknown or already used	Terminal. Start a new device authorization
`server_error`	500	Transient failure	Retry the poll

Branch on the error field, not the status code. authorization_pending and slow_down are the only outcomes that mean “keep polling” — every other error on a 400 is terminal, including access_denied. A loop that treats every 400 as “still pending” never terminates on a declined or expired code.

Status codes

Code	Meaning
200	Token issued
400	Not approved yet, denied, expired, or an unusable device code — see `error`
500	Transient failure — retry the poll

There is no rate limit on this endpoint.

Using the token

curl https://api.noorle.com/v1/capabilities \
  -H "Authorization: Bearer eyJhbGc..."

Store it with restrictive permissions — it is a bearer credential with your account authority for the next hour.

Overview

REST API

MCP Protocol

A2A Protocol

Noorle CLI

Request

Response

Polling responses

Status codes

Using the token

​Request

​Response

​Polling responses

​Status codes

​Using the token

​Related

Request

Response

Polling responses

Status codes

Using the token

Related