OAuth2

Documentation Index

Fetch the complete documentation index at: https://open.manus.ai/docs/llms.txt

Use this file to discover all available pages before exploring further.

​

Overview

​

Creating an OAuth app

​

Redirect URI rules

• Must be an absolute URI (include scheme).
• No wildcards (*). No fragments (#).
• Forbidden schemes: javascript, data, file, about, vbscript.
• http / https must include a host.
• Custom schemes are allowed (e.g. com.example.app://oauth) for native apps.
• Matched exactly at authorization time (RFC 6749 §3.1.2).

​

Scopes

{
  "client_id": "client_xxx",
  "scope_config": {
    "scopes": ["create_task", "use_connectors"],
    "connector_uids": ["bbb0df76-..."]
  }
}

​

Available scopes

​

Task visibility by scope

​

Authorization flow

​

Step 1: Redirect to authorization

https://manus.im/openapi/oauth?client_id={client_id}

​

Step 2: Receive the authorization code

{redirect_uri}?code={code}&state={state}

• Format: code_{client_id}_{shortuuid}
• Expires in 10 minutes
• Single-use (atomic consumption, prevents replay)

​

Step 3: Exchange code for tokens

curl -X POST https://api.manus.ai/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "{authorization_code}",
    "redirect_uri": "{redirect_uri}",
    "client_id": "{client_id}",
    "client_secret": "{client_secret}",
    "code_verifier": "{code_verifier}"
  }'

curl -X POST https://api.manus.ai/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "{authorization_code}",
    "redirect_uri": "{redirect_uri}",
    "client_id": "{client_id}",
    "client_secret": "{client_secret}"
  }'

curl -X POST https://api.manus.ai/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "{authorization_code}",
    "redirect_uri": "{redirect_uri}",
    "client_id": "{client_id}",
    "code_verifier": "{code_verifier}"
  }'

{
  "access_token": "eyJhbGciOiJI...",
  "token_type": "Bearer",
  "expires_in": 86400,
  "refresh_token": "refresh_xxx_xxx_xxx",
  "scope": "create_task use_connectors"
}

​

Step 4: Refresh tokens

curl -X POST https://api.manus.ai/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "refresh_token",
    "refresh_token": "{refresh_token}",
    "client_id": "{client_id}",
    "client_secret": "{client_secret}"
  }'

• PKCE + Secret flow: both client_secret and code_verifier are required for refresh.
• Secret flow: client_secret is required for refresh.
• PKCE flow: client_secret is not required for refresh.
• Refresh atomically revokes the old token pair and issues new ones (prevents refresh token replay).

​

Token invalidation

• Expired
• Explicitly revoked
• The associated OAuth app has been deleted
• The app’s scopes were expanded (adding new scopes or connector UIDs invalidates all existing tokens)

​

Using OAuth tokens

curl https://api.manus.ai/v2/task.list \
  -H "Authorization: Bearer {access_token}"

​

Available endpoints

​

Revoking tokens

​

App-side: revoke a single token (RFC 7009)

curl -X POST https://api.manus.ai/oauth/revoke \
  -H "Content-Type: application/json" \
  -d '{
    "token": "{access_token_or_refresh_token}",
    "token_type_hint": "access_token",
    "client_id": "{client_id}",
    "client_secret": "{client_secret}"
  }'

• token_type_hint is optional (access_token or refresh_token) — optimizes lookup order.
• Always returns HTTP 200 if client credentials are valid, regardless of whether the token exists (RFC 7009).
• PKCE-issued tokens do not require client_secret for revocation.

​

User-side: revoke grants

​

Connector authorization

1. App setup: Enable use_connectors scope and select the connectors your app needs in the Manus Integrations settings.
2. User consent: The consent page shows the connector list. The user selects which connectors to authorize.
3. Runtime: The token must have the use_connectors scope, and the specific connector must be within the user’s granted set.

​

Updating connector consent

https://manus.im/oauth-apps/connector-consent?client_id={client_id}

​

App skills

​

App webhook

​

Secret management

​

Rate limits

​

Error handling

​

Token endpoint errors (/oauth/token and /oauth/revoke)

{
  "error": "invalid_grant",
  "error_description": "authorization grant is invalid or expired"
}

​

Insufficient scope

{
  "code": "permission_denied",
  "message": "insufficient_scope: required one of [create_task, manage_all_tasks]"
}

​

Best practices

1. Store secrets securely. client_secret is only shown once at creation. Use a secrets manager — never hardcode it.
2. Request minimal scopes. Only request what your app actually needs. Avoid manage_all_tasks unless you truly need access to all user tasks.
3. Implement token refresh. Access tokens expire in 24 hours. Use the refresh token to renew automatically.
4. Handle token invalidation gracefully. On 401, try refreshing. If refresh fails, redirect the user to re-authorize.
5. Rotate secrets regularly. Use multi-secret support for zero-downtime rotation.
6. Prefer PKCE for client-side apps. Native apps and SPAs should use PKCE — never embed a client_secret in client-side code.
7. Validate the state parameter. Always verify state on the callback to prevent CSRF attacks.
8. Implement backoff on 429. Token endpoints are limited to 60 req/min. Use exponential backoff with jitter.