Get Token

Exchange an approved device code for an access token.

POST https://api.noorle.com/oauth/token
Content-Type: application/json

This endpoint accepts one grant type only: urn:ietf:params:oauth:grant-type:device_code. refresh_token and client_credentials are rejected.

Request

curl -X POST https://api.noorle.com/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "urn:ietf:params:oauth:grant-type:device_code",
    "code": "dc_k3Jd82nfPqW0zXbA7yTvR5mLcH1sGe4U",
    "client_id": "noorle-cli"
  }'

Field	Type	Required	Description
`grant_type`	string	Yes	Must be `urn:ietf:params:oauth:grant-type:device_code`
`code`	string	Yes	The `device_code` from `/oauth/device/authorize`
`client_id`	string	Yes	The same client id used to start the flow

The field is named code, not device_code. The device-authorize response calls it device_code; the field you send it back in is code. A request with an empty code is rejected as a malformed request.

Response

The token response is returned bare. Unlike the /v1 endpoints, it is not wrapped in a data envelope — read the fields off the top level of the body.

{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "..."
}

Field	Type	Description
`access_token`	string	HS256 JWT. Send as `Authorization: Bearer`
`token_type`	string	Always `Bearer`
`expires_in`	integer	3600 — one hour
`scope`	string	Granted scope

The access token’s claims carry iss (the management API host), sub (your user id), aud (the client_id), account_id, scope, iat, and exp. A successful exchange consumes the device session — the device code is single-use.

There is no refresh flow on this host. api.noorle.com accepts the device-code grant and nothing else, so there is no way to exchange a token for a fresh one. When the hour is up, run the device flow again — or use an API key, which does not expire on a fixed clock.

Polling responses

Poll on the interval returned by /oauth/device/authorize. The exchange sits in one of four states.

Status	Meaning	What to do
200	Approved — token issued	Stop polling
400	Either still pending, or the device code is no longer usable — unknown, already redeemed, expired, or an unsupported grant type	Wait `interval` seconds and poll again, up to your attempt cap
403	Denied — the human rejected the request	Stop polling

Branch on the status code. A 400 does not distinguish “not decided yet” from “this code is finished”, so a correct client polls on the interval and gives up after a bounded number of attempts rather than waiting for a terminal 400. A denial deletes the device session, so a poll after a 403 reports the code as unusable rather than denied.

Status codes

Code	Meaning
200	Token issued
400	Not approved yet, an unusable device code, or an unsupported grant type
403	The human denied the authorization

There is no rate limit on this endpoint.

Using the token

curl https://api.noorle.com/v1/capabilities \
  -H "Authorization: Bearer eyJhbGc..."

Store it with restrictive permissions — it is a bearer credential with your account authority for the next hour.

Overview

REST API

MCP Protocol

A2A Protocol

Noorle CLI

Request

Response

Polling responses

Status codes

Using the token

​Request

​Response

​Polling responses

​Status codes

​Using the token

​Related

Request

Response

Polling responses

Status codes

Using the token

Related