OAuth
MCP

MCP OAuth token endpoint proxy (authorization_code + refresh_token)

Forwards authorization_code and refresh_token grants to Supabase /auth/v1/oauth/token. Discovered as token_endpoint from /.well-known/oauth-authorization-server for MCP clients.

Accepts both application/x-www-form-urlencoded (OAuth 2.1 standard) and application/json request bodies.

RFC 8707 (Resource Indicators): clients MAY include an optional resource parameter. The canonical value is the production MCP endpoint (https://api.apphandoff.com/mcp). During the compatibility transition, the API base URL and legacy /api/mcp-bot endpoint remain accepted as exact aliases; all other values return invalid_target (HTTP 400). The value is forwarded upstream so RFC 8707-aware issuers can populate the JWT aud claim.

post/oauth/token

Request

  • Base URL: https://api.apphandoff.com/api
  • URL: https://api.apphandoff.com/api/oauth/token
  • Auth: none required

Request body

OR

Response

Token payload from Supabase

object required

Changes

No recorded changes to this operation across all 1 revision of this API.