---
title: "Exchange or refresh an MCP OAuth token"
method: POST
path: "/credits/mcp/oauth/token"
tags: ["MCP"]
---

# Exchange or refresh an MCP OAuth token

`POST /credits/mcp/oauth/token`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/mcp/oauth/token`
- Auth: none required

Public-client token endpoint. Client secrets and Authorization headers are not supported. Authorization-code exchange requires the PKCE verifier; device clients poll no faster than the returned interval and handle authorization_pending, slow_down, access_denied, and expired_token; refresh tokens rotate on every successful use.

## Request body `application/x-www-form-urlencoded`

- union
  - object
    - `grant_type` 'authorization_code', required
    - `client_id` string, required
    - `resource` string, uri, required
    - `code` string, required
    - `redirect_uri` string, uri, required
    - `code_verifier` string, required
  - object
    - `grant_type` 'urn:ietf:params:oauth:grant-type:device_code', required
    - `client_id` string, required
    - `resource` string, uri, required
    - `device_code` string, required
  - object
    - `grant_type` 'refresh_token', required
    - `client_id` string, required
    - `resource` string, uri, required
    - `refresh_token` string, required
    - `scope` string

## Response `200`

Resource-bound bearer token

- McpOAuthTokenResponse
  - `access_token` string, required
  - `token_type` 'Bearer', required
  - `expires_in` integer, required
  - `refresh_token` string: Present when offline_access was granted; rotated on every refresh.
  - `scope` string, required
  - `resource` string, uri, required

## Other responses

- `400`: Invalid request, grant, target, or grant type
- `401`: Unknown client or unsupported client authentication
- `415`: Content type must be application/x-www-form-urlencoded

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)