Token request
Exchange an authorization code (with its PKCE code_verifier) for
tokens, or rotate a session with grant_type=refresh_token
(RFC 6749 §4.1.3 and §6). Public client — no client authentication
(token_endpoint_auth_method is none). The request body is
application/x-www-form-urlencoded.
Body
Form-encoded token request. Send grant_type=authorization_code with
code, client_id, redirect_uri, and code_verifier; or
grant_type=refresh_token with refresh_token.
authorization_code, refresh_token "authorization_code"
The authorization code (for authorization_code).
The client identifier (for authorization_code).
"oac_01jqebhswje1ka1z7ahr9rfsgt"
Must match the redirect_uri used at /authorize (for authorization_code).
"https://mcp.example.com/oauth/callback"
PKCE code verifier matching the code_challenge (for authorization_code).
The refresh token to rotate (for refresh_token).
Response
OK
RFC 6749 §5.1 access token response.