Documentation Index

Fetch the complete documentation index at: https://open.manus.ai/docs/llms.txt

Use this file to discover all available pages before exploring further.

​

App management

​

Creating an OAuth app

​

Redirect URI rules

• Must be an absolute URI (include scheme).
• No wildcards (*). No fragments (#).
• Forbidden schemes: javascript, data, file, about, vbscript.
• http / https must include a host.
• Custom schemes are allowed (e.g. com.example.app://oauth) for native apps.
• Matched exactly at authorization time (RFC 6749 §3.1.2).

​

Secret management

​

OAuth flow

​

Overview

​

Scopes

​

Authorization flow

​

Step 1: Redirect to authorization

https://manus.im/openapi/oauth?client_id={client_id}&redirect_uri={redirect_uri}&state={state}

​

Step 2: Receive the authorization code

{redirect_uri}?code={code}&state={state}

• Format: code_{client_id}_{shortuuid}
• Expires in 10 minutes
• Single-use (atomic consumption, prevents replay)

​

Step 3: Exchange code for tokens

curl -X POST https://api.manus.ai/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "{authorization_code}",
    "redirect_uri": "{redirect_uri}",
    "client_id": "{client_id}",
    "client_secret": "{client_secret}",
    "code_verifier": "{code_verifier}"
  }'

curl -X POST https://api.manus.ai/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "{authorization_code}",
    "redirect_uri": "{redirect_uri}",
    "client_id": "{client_id}",
    "client_secret": "{client_secret}"
  }'

curl -X POST https://api.manus.ai/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "{authorization_code}",
    "redirect_uri": "{redirect_uri}",
    "client_id": "{client_id}",
    "code_verifier": "{code_verifier}"
  }'

{
  "access_token": "eyJhbGciOiJI...",
  "token_type": "Bearer",
  "expires_in": 86400,
  "refresh_token": "refresh_xxx_xxx_xxx",
  "scope": "create_task use_connectors"
}

​

Step 4: Refresh tokens

curl -X POST https://api.manus.ai/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "refresh_token",
    "refresh_token": "{refresh_token}",
    "client_id": "{client_id}",
    "client_secret": "{client_secret}"
  }'

• PKCE + Secret flow: both client_secret and code_verifier are required for refresh.
• Secret flow: client_secret is required for refresh.
• PKCE flow: client_secret is not required for refresh.
• Refresh atomically revokes the old token pair and issues new ones (prevents refresh token replay).

​

Token invalidation

• Expired
• Explicitly revoked
• The associated OAuth app has been deleted
• The app’s scopes were expanded (adding new scopes or connector UIDs invalidates all existing tokens)

​

Revoking tokens

​

App-side: revoke a single token (RFC 7009)

curl -X POST https://api.manus.ai/oauth/revoke \
  -H "Content-Type: application/json" \
  -d '{
    "token": "{access_token_or_refresh_token}",
    "token_type_hint": "access_token",
    "client_id": "{client_id}",
    "client_secret": "{client_secret}"
  }'

• token_type_hint is optional (access_token or refresh_token) — optimizes lookup order.
• Always returns HTTP 200 if client credentials are valid, regardless of whether the token exists (RFC 7009).
• PKCE-issued tokens do not require client_secret for revocation.

​

User-side: revoke grants

​

Available endpoints

curl https://api.manus.ai/v2/task.list \
  -H "Authorization: Bearer {access_token}"

​

API behavior with OAuth

​

Task visibility

​

Connectors

• Explicitly passed in message.connectors — returns an error if the user has not authorized the connector:
  {
    "code": "permission_denied",
    "message": "insufficient_scope: connector {uid} not granted"
  }
  
• Not passed (relying on defaults) — unauthorized connectors are silently filtered out. The task is created normally but without those connectors.

https://manus.im/oauth-apps/connector-consent?client_id={client_id}

​

Skills

​

Webhook

​

Reference

​

Rate limits

​

OAuth endpoints

​

OpenAPI v2 endpoints

​

Error handling

​

Token endpoint errors (/oauth/token and /oauth/revoke)

{
  "error": "invalid_grant",
  "error_description": "authorization grant is invalid or expired"
}

​

Insufficient scope

{
  "code": "permission_denied",
  "message": "insufficient_scope: required one of [create_task, manage_all_tasks]"
}

{
  "code": "permission_denied",
  "message": "insufficient_scope: connector {uid} not granted"
}

​

Best practices

1. Store secrets securely. client_secret is only shown once at creation. Use a secrets manager — never hardcode it.
2. Request minimal scopes. Only request what your app actually needs. Avoid manage_all_tasks unless you truly need access to all user tasks.
3. Implement token refresh. Access tokens expire in 24 hours. Use the refresh token to renew automatically.
4. Handle token invalidation gracefully. On 401, try refreshing. If refresh fails, redirect the user to re-authorize.
5. Rotate secrets regularly. Use multi-secret support for zero-downtime rotation.
6. Prefer PKCE for client-side apps. Native apps and SPAs should use PKCE — never embed a client_secret in client-side code.
7. Validate the state parameter. Always verify the returned state matches the value you sent to prevent CSRF attacks.
8. Implement backoff on 429. Token endpoints are limited to 60 req/min. Use exponential backoff with jitter.