---
title: "App MCP token endpoint"
method: POST
path: "/_run402/oauth/token"
tags: ["Stable Hosts"]
---

# App MCP token endpoint

`POST /_run402/oauth/token`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/_run402/oauth/token`
- Auth: none required

`grant_type=authorization_code` (with `code_verifier`) or `refresh_token` (rotates both tokens; a replayed refresh token revokes the grant). Opaque tokens: access 1 hour, grant at most 90 days.

## Response `200`

`{access_token, refresh_token, token_type, expires_in, scope}`, plus `id_token` (ES256, 5 minutes; `iss` this app's issuer, `sub` the user id, `aud` the client_id, `auth_time`, `nonce`, and `email`/`email_verified` or `name`/`picture` per scope) when the code was granted `openid`.

- object

## Other responses

- `400`: OAuth error body (`error`, `error_description`), RFC 6749 §5.2.
- `429`: Rate limited; `Retry-After`.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)