MCP OAuth

Exchange an authorization code or refresh token.

Supports authorization_code with PKCE S256 and refresh_token with rotation.

post/mcp/oauth/token

Request

Request body

OR

Response

MCP OAuth token response.

access_tokenstring required

Short-lived JWT for /api/v1/mcp.

token_type'Bearer' required
expires_ininteger required
refresh_tokenstring required

Opaque refresh token. Store securely.

scopestring required

Example response

{
  "expires_in": 900,
  "scope": "workspace:read leads:read leads:contact_read analytics:read agent:read"
}

Changes

No recorded changes to this operation across all 12 revisions of this API.