Skip to main content
POST
Exchange an OAuth authorization code
Authenticate the OAuth client using its registered method: none, client_secret_basic or client_secret_post. Client credentials are distinct from a user’s API key. Uses an authorization code once with the original redirect URI, MCP resource and PKCE verifier. This server does not issue refresh tokens. Client authentication follows the registered method. Request conventions · API keys · MCP connections

Authorizations

Authorization
string
header
required

Registered OAuth client authentication, when client_secret_basic is selected

Body

application/x-www-form-urlencoded
grant_type
string
required
Allowed value: "authorization_code"
code
string
required
redirect_uri
string<uri>
required
code_verifier
string
required
resource
string<uri>
required
client_id
string
client_secret
string

Response

Successful response. Examples are illustrative; field values vary by record.

access_token
string
token_type
string
expires_in
integer
scope
string