Sign in
v2
mcp
mcp

Exchange OAuth code for MCP tokens

Exchange the authorization code for tokens and store the credential.

The frontend calls this after receiving the OAuth code from the popup. On success, subsequent /discover-tools calls for the same server URL will automatically use the stored credential.

post/api/mcp/oauth/callback

Request body

codestring required

Authorization code from OAuth callback

state_tokenstring required

State token for CSRF verification

issstring nullable

Issuer identifier from the authorization response (RFC 9207). Must match the authorization server discovered at login; required when that server advertises authorization_response_iss_parameter_supported.

Response

Successful Response

idstring required
providerstring required
type'api_key' | 'oauth2' | 'user_password' | 'host_scoped' | 'device_code' required
titlestring nullable required
scopesstring[] nullable required
usernamestring nullable required
hoststring nullable

Host pattern for host-scoped or MCP server URL for MCP credentials

mcp_auth_scheme'basic' | 'bearer' nullable

Manual authorization scheme for MCP credentials

is_managedboolean

Changes

Changed in 2 of the 165 revisions of this API.12

  • d3946c727d242See the full diff
    • ○

      added the new optional request property

      new-optional-request-property

    • ○

      added the optional property to the response with the status

      response-optional-property-added

  • ae1be5efc67a1See the full diff
    • ●

      added the new device_code enum value to the response property for the response status

      response-property-enum-value-added