Get an access token

Exchanges an API key for an OAuth 2.0 access token using the client-credentials grant: client_id is the API key's id and client_secret is the key's secret. The returned token is a reference to the key rather than a copy of its permissions, so revoking the key immediately invalidates every token issued from it, and any permission change takes effect on the token's next use without needing a refresh. Responses follow the OAuth specification, including invalid_client on an authentication failure and unsupported_grant_type for an unsupported grant. This endpoint is rate-limited per IP address.

Notes.

• RFC 6749: no { data } envelope, and errors use OAuth's error + error_description.
• The schema shown is the client-credentials answer. The authorization_code and refresh_token grants serve apps connected by a person (MCP) and also return refresh_token.