Exchange an OAuth authorization code
curl --request POST \
--url https://posted-api.example.com/oauth/token \
--header 'Authorization: Basic <encoded-value>' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data grant_type=authorization_code \
--data 'code=<string>' \
--data 'redirect_uri=<string>' \
--data 'code_verifier=<string>' \
--data 'resource=<string>' \
--data 'client_id=<string>' \
--data 'client_secret=<string>'import requests
url = "https://posted-api.example.com/oauth/token"
payload = {
"grant_type": "authorization_code",
"code": "<string>",
"redirect_uri": "<string>",
"code_verifier": "<string>",
"resource": "<string>",
"client_id": "<string>",
"client_secret": "<string>"
}
headers = {
"Authorization": "Basic <encoded-value>",
"Content-Type": "application/x-www-form-urlencoded"
}
response = requests.post(url, data=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
Authorization: 'Basic <encoded-value>',
'Content-Type': 'application/x-www-form-urlencoded'
},
body: new URLSearchParams({
grant_type: 'authorization_code',
code: '<string>',
redirect_uri: '<string>',
code_verifier: '<string>',
resource: '<string>',
client_id: '<string>',
client_secret: '<string>'
})
};
fetch('https://posted-api.example.com/oauth/token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://posted-api.example.com/oauth/token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "grant_type=authorization_code&code=%3Cstring%3E&redirect_uri=%3Cstring%3E&code_verifier=%3Cstring%3E&resource=%3Cstring%3E&client_id=%3Cstring%3E&client_secret=%3Cstring%3E",
CURLOPT_HTTPHEADER => [
"Authorization: Basic <encoded-value>",
"Content-Type: application/x-www-form-urlencoded"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://posted-api.example.com/oauth/token"
payload := strings.NewReader("grant_type=authorization_code&code=%3Cstring%3E&redirect_uri=%3Cstring%3E&code_verifier=%3Cstring%3E&resource=%3Cstring%3E&client_id=%3Cstring%3E&client_secret=%3Cstring%3E")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Basic <encoded-value>")
req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://posted-api.example.com/oauth/token")
.header("Authorization", "Basic <encoded-value>")
.header("Content-Type", "application/x-www-form-urlencoded")
.body("grant_type=authorization_code&code=%3Cstring%3E&redirect_uri=%3Cstring%3E&code_verifier=%3Cstring%3E&resource=%3Cstring%3E&client_id=%3Cstring%3E&client_secret=%3Cstring%3E")
.asString();require 'uri'
require 'net/http'
url = URI("https://posted-api.example.com/oauth/token")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Basic <encoded-value>'
request["Content-Type"] = 'application/x-www-form-urlencoded'
request.body = "grant_type=authorization_code&code=%3Cstring%3E&redirect_uri=%3Cstring%3E&code_verifier=%3Cstring%3E&resource=%3Cstring%3E&client_id=%3Cstring%3E&client_secret=%3Cstring%3E"
response = http.request(request)
puts response.read_body{
"access_token": "example-private-oauth-token",
"token_type": "Bearer",
"expires_in": 2592000,
"scope": "read"
}{
"error": "<string>",
"error_description": "<string>"
}Exchange an OAuth authorization code
Uses an authorization code once with the original redirect URI, MCP resource and PKCE verifier. This server does not issue refresh tokens. Client authentication follows the registered method.
POST
/
oauth
/
token
Exchange an OAuth authorization code
curl --request POST \
--url https://posted-api.example.com/oauth/token \
--header 'Authorization: Basic <encoded-value>' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data grant_type=authorization_code \
--data 'code=<string>' \
--data 'redirect_uri=<string>' \
--data 'code_verifier=<string>' \
--data 'resource=<string>' \
--data 'client_id=<string>' \
--data 'client_secret=<string>'import requests
url = "https://posted-api.example.com/oauth/token"
payload = {
"grant_type": "authorization_code",
"code": "<string>",
"redirect_uri": "<string>",
"code_verifier": "<string>",
"resource": "<string>",
"client_id": "<string>",
"client_secret": "<string>"
}
headers = {
"Authorization": "Basic <encoded-value>",
"Content-Type": "application/x-www-form-urlencoded"
}
response = requests.post(url, data=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
Authorization: 'Basic <encoded-value>',
'Content-Type': 'application/x-www-form-urlencoded'
},
body: new URLSearchParams({
grant_type: 'authorization_code',
code: '<string>',
redirect_uri: '<string>',
code_verifier: '<string>',
resource: '<string>',
client_id: '<string>',
client_secret: '<string>'
})
};
fetch('https://posted-api.example.com/oauth/token', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://posted-api.example.com/oauth/token",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => "grant_type=authorization_code&code=%3Cstring%3E&redirect_uri=%3Cstring%3E&code_verifier=%3Cstring%3E&resource=%3Cstring%3E&client_id=%3Cstring%3E&client_secret=%3Cstring%3E",
CURLOPT_HTTPHEADER => [
"Authorization: Basic <encoded-value>",
"Content-Type: application/x-www-form-urlencoded"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://posted-api.example.com/oauth/token"
payload := strings.NewReader("grant_type=authorization_code&code=%3Cstring%3E&redirect_uri=%3Cstring%3E&code_verifier=%3Cstring%3E&resource=%3Cstring%3E&client_id=%3Cstring%3E&client_secret=%3Cstring%3E")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Basic <encoded-value>")
req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://posted-api.example.com/oauth/token")
.header("Authorization", "Basic <encoded-value>")
.header("Content-Type", "application/x-www-form-urlencoded")
.body("grant_type=authorization_code&code=%3Cstring%3E&redirect_uri=%3Cstring%3E&code_verifier=%3Cstring%3E&resource=%3Cstring%3E&client_id=%3Cstring%3E&client_secret=%3Cstring%3E")
.asString();require 'uri'
require 'net/http'
url = URI("https://posted-api.example.com/oauth/token")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Basic <encoded-value>'
request["Content-Type"] = 'application/x-www-form-urlencoded'
request.body = "grant_type=authorization_code&code=%3Cstring%3E&redirect_uri=%3Cstring%3E&code_verifier=%3Cstring%3E&resource=%3Cstring%3E&client_id=%3Cstring%3E&client_secret=%3Cstring%3E"
response = http.request(request)
puts response.read_body{
"access_token": "example-private-oauth-token",
"token_type": "Bearer",
"expires_in": 2592000,
"scope": "read"
}{
"error": "<string>",
"error_description": "<string>"
}Authenticate the OAuth client using its registered method: none, client_secret_basic or client_secret_post. Client credentials are distinct from a user’s API key.
Uses an authorization code once with the original redirect URI, MCP resource and PKCE verifier. This server does not issue refresh tokens. Client authentication follows the registered method.
Request conventions · API keys · MCP connections
Authorizations
Registered OAuth client authentication, when client_secret_basic is selected
Body
application/x-www-form-urlencoded
Was this page helpful?
