---
title: "MCP inspector OAuth token exchange proxy"
method: POST
path: "/oauth/mcp-inspector/token"
tags: ["OAuth", "MCP"]
---

# MCP inspector OAuth token exchange proxy

`POST /oauth/mcp-inspector/token`

## Request

- Base URL: `https://api.apphandoff.com/api`
- URL: `https://api.apphandoff.com/api/oauth/mcp-inspector/token`
- Auth: none required

Exchanges authorization codes or refresh tokens for the local MCP inspector.
Proxies to Supabase OAuth token exchange while keeping anon key usage server-side.

## Request body

- object
  - `grant_type` 'authorization_code' | 'refresh_token', required
  - `code` string: Required when grant_type is authorization_code
  - `redirect_uri` string: Must be localhost/127.0.0.1 HTTP or https://local.apphandoff.com
  - `code_verifier` string: PKCE code verifier (43-128 chars) for authorization_code flow
  - `refresh_token` string: Required when grant_type is refresh_token
  - `client_id` string, uuid, required

## Response `200`

Token exchange payload from Supabase

- object

## Other responses

- `400`: Invalid request
- `429`: Rate limited
- `500`: Server error

---

[API](https://skmtc.dev/apphandoff/apis/apphandoff-api.md) · [All operations](https://skmtc.dev/apphandoff/apis/apphandoff-api/llms.txt) · [OpenAPI document](https://skmtc.dev/apphandoff/apis/apphandoff-api/revisions/9f138fe46d56?raw)