---
title: "Exchange an authorization code or refresh token."
method: POST
path: "/mcp/oauth/token"
tags: ["MCP OAuth"]
---

# Exchange an authorization code or refresh token.

`POST /mcp/oauth/token`

## Request

- Base URL: `https://api.traxy.ai/api/v1`
- URL: `https://api.traxy.ai/api/v1/mcp/oauth/token`
- Auth: none required
- TypeScript: <https://skmtc.dev/windmill-growth/apis/traxy-customer-api-and-mcp-v1/docs/mcp/oauth/token/post.ts> (a function with typed inputs; its response is checked against the schema)

Supports authorization_code with PKCE S256 and refresh_token with rotation.

## Request body

- union
  - object
    - `grant_type` 'authorization_code', required
    - `code` string, required
    - `redirect_uri` string, uri, required
    - `client_id` string, required
    - `code_verifier` string, required
    - `resource` string, uri
  - object
    - `grant_type` 'refresh_token', required
    - `refresh_token` string, required
    - `client_id` string, required
    - `scope` string
    - `resource` string, uri

## Response `200`

MCP OAuth token response.

- McpOAuthTokenResponse
  - `access_token` string, required: Short-lived JWT for `/api/v1/mcp`.
  - `token_type` 'Bearer', required
  - `expires_in` integer, required
  - `refresh_token` string, required: Opaque refresh token. Store securely.
  - `scope` string, required

## Other responses

- `400`: Request failed boundary validation.
- `401`: Invalid, expired, revoked, or wrong-audience MCP OAuth token. Response includes a WWW-Authenticate challenge with resource metadata.

---

[API](https://skmtc.dev/windmill-growth/apis/traxy-customer-api-and-mcp-v1.md) - [All operations](https://skmtc.dev/windmill-growth/apis/traxy-customer-api-and-mcp-v1/llms.txt) - [OpenAPI document](https://skmtc.dev/windmill-growth/apis/traxy-customer-api-and-mcp-v1/revisions/765b1a6a3abd?raw)