Skip to main content
POST
Token request

Body

application/x-www-form-urlencoded

Form-encoded token request. Send grant_type=authorization_code with code, client_id, redirect_uri, and code_verifier; or grant_type=refresh_token with refresh_token.

grant_type
enum<string>
required
Available options:
authorization_code,
refresh_token
Example:

"authorization_code"

code
string

The authorization code (for authorization_code).

client_id
string

The client identifier (for authorization_code).

Example:

"oac_01jqebhswje1ka1z7ahr9rfsgt"

redirect_uri
string

Must match the redirect_uri used at /authorize (for authorization_code).

Example:

"https://mcp.example.com/oauth/callback"

code_verifier
string

PKCE code verifier matching the code_challenge (for authorization_code).

refresh_token
string

The refresh token to rotate (for refresh_token).

Response

OK

RFC 6749 §5.1 access token response.

access_token
string
required
Example:

"eyJhbGciOiJFZERTQSIsInR5cCI6IkpXVCJ9..."

token_type
string
required
Example:

"Bearer"

expires_in
integer<int64>
required

Seconds until the access token expires.

Example:

3600

refresh_token
string
scope
string

Space-delimited scopes granted to the session.

Example:

"mcp:read"