> ## Documentation Index
> Fetch the complete documentation index at: https://www.posted.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange an OAuth authorization code

> Uses an authorization code once with the original redirect URI, MCP resource and PKCE verifier. This server does not issue refresh tokens. Client authentication follows the registered method.

Authenticate the OAuth client using its registered method: none, client\_secret\_basic or client\_secret\_post. Client credentials are distinct from a user's API key.

Uses an authorization code once with the original redirect URI, MCP resource and PKCE verifier. This server does not issue refresh tokens. Client authentication follows the registered method.

[Request conventions](/api-reference/overview) · [API keys](/api-keys) · [MCP connections](/mcp-connections)


## OpenAPI

````yaml api-reference/openapi.json POST /oauth/token
openapi: 3.1.0
info:
  title: Posted HTTP API
  version: 0.2.0
  description: >-
    All registered application, account, OAuth, MCP transport and health
    endpoints. Publishing and draft request schemas come from the shared runtime
    validators. Replace the example server with your installation. Documentation
    uses simple request examples and does not execute live publishing requests.
servers:
  - url: https://posted-api.example.com
security: []
paths:
  /oauth/token:
    post:
      tags:
        - OAuth and MCP transport
      summary: Exchange an OAuth authorization code
      description: >-
        Uses an authorization code once with the original redirect URI, MCP
        resource and PKCE verifier. This server does not issue refresh tokens.
        Client authentication follows the registered method.


        Authenticate the OAuth client using its registered method: none,
        client_secret_basic or client_secret_post. Client credentials are
        distinct from a user's API key.
      operationId: post_oauth_token
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              properties:
                client_id:
                  type: string
                client_secret:
                  type: string
                grant_type:
                  type: string
                  const: authorization_code
                code:
                  type: string
                redirect_uri:
                  type: string
                  format: uri
                code_verifier:
                  type: string
                resource:
                  type: string
                  format: uri
              required:
                - grant_type
                - code
                - redirect_uri
                - code_verifier
                - resource
      responses:
        '200':
          description: >-
            Successful response. Examples are illustrative; field values vary by
            record.
          content:
            application/json:
              schema:
                type: object
                properties:
                  access_token:
                    type: string
                  token_type:
                    type: string
                  expires_in:
                    type: integer
                  scope:
                    type: string
                additionalProperties: true
              example:
                access_token: example-private-oauth-token
                token_type: Bearer
                expires_in: 2592000
                scope: read
        default:
          description: >-
            OAuth failure with error and error_description. Consent/session
            authority may also return the standard Posted error envelope.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                  error_description:
                    type: string
      security:
        - oauthClientBasic: []
        - {}
components:
  securitySchemes:
    oauthClientBasic:
      type: http
      scheme: basic
      description: >-
        Registered OAuth client authentication, when client_secret_basic is
        selected

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.