---
title: "OAuth 2.0 token endpoint (RFC 6749)"
method: POST
path: "/oauth/token"
tags: ["OAuth"]
---

# OAuth 2.0 token endpoint (RFC 6749)

`POST /oauth/token`

## Request

- Base URL: `https://headlessoracle.com`
- URL: `https://headlessoracle.com/oauth/token`
- Auth: none declared

Client Credentials grant. client_id = existing Oracle API key. Returns a short-lived opaque bearer token (3600s TTL) for MCP authentication.

## Response `200`

Token issued

- object
  - `access_token` string
  - `token_type` string
  - `expires_in` integer
  - `scope` string

## Other responses

- `400`: Invalid request (missing client_id or unsupported grant type)
- `401`: Invalid client (API key not recognised)
- `405`: Method not allowed — use POST

---

[API](https://skmtc.dev/headlessoracle/apis/headless-oracle.md) · [All operations](https://skmtc.dev/headlessoracle/apis/headless-oracle/llms.txt) · [OpenAPI document](https://skmtc.dev/headlessoracle/apis/headless-oracle/revisions/4e82fe332f29?raw)