SIsignificant-gravitas
v2
mcp
mcp

Exchange OAuth code for MCP tokens

Changed on

Exchange the authorization code for tokens and store the credential.

The frontend calls this after receiving the OAuth code from the popup. On success, subsequent /discover-tools calls for the same server URL will automatically use the stored credential.

post/api/mcp/oauth/callback

Request

  • The document declares no server URL.
  • Auth
    HTTP bearer

Request body

codestring required

Authorization code from OAuth callback

state_tokenstring required

State token for CSRF verification

issstring nullable

Issuer identifier from the authorization response (RFC 9207). Must match the authorization server discovered at login; required when that server advertises authorization_response_iss_parameter_supported.

Response

Successful Response

idstring required
providerstring required
type'api_key' | 'oauth2' | 'user_password' | 'host_scoped' | 'device_code' required
titlestring nullable required
scopesstring[] nullable required
usernamestring nullable required
hoststring nullable

Host pattern for host-scoped or MCP server URL for MCP credentials

scopestring nullable

What a user/password login may be used for, e.g. smtp://host[:port]; null for a login saved before scopes existed

mcp_auth_scheme'basic' | 'bearer' nullable

Manual authorization scheme for MCP credentials

is_managedboolean
servicestring
service_namestring nullable
service_iconstring nullable

Changes

  • c508818c16adRevision changes
    • info

      added the optional property to the response with the status

  • 69ae03c98fdcRevision changes
    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status

    • info

      added the optional property to the response with the status