---
title: "MCP OAuth token endpoint"
method: POST
path: "/v1/mcp/oauth/token"
tags: ["mcp"]
---

# MCP OAuth token endpoint

`POST /v1/mcp/oauth/token`

## Request

- Base URL: `https://api.thebridge.dev` (the document declares no server; this is the origin it was published from)
- URL: `https://api.thebridge.dev/v1/mcp/oauth/token`
- Auth: none declared

Exchanges an authorization code + PKCE verifier (grant_type=authorization_code), or a refresh token (grant_type=refresh_token, rotated on every use), for a Bearer ApiToken JWT (source: bridge-mcp) plus a refresh token. Accepts application/x-www-form-urlencoded (what MCP clients send) and application/json. Public clients — the code or refresh token is the auth.

## Response `200`

Token issued

## Other responses

- `400`: invalid_request | invalid_grant | unsupported_grant_type
- `401`: invalid_client

---

[API](https://skmtc.dev/thebridge/apis/bridge-api.md) · [All operations](https://skmtc.dev/thebridge/apis/bridge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thebridge/apis/bridge-api/revisions/290fffcb3d80?raw)