Exchange a code or refresh token for an access token
POST/token
The token endpoint, serving the authorization_code and refresh_token grants. The client
authenticates with client_secret_basic, client_secret_post, or none for a public client.
The access token it returns is a SOAT-issued JWT: send it as Authorization: Bearer <token>
to /mcp and to the REST API. Refresh tokens are single-use and rotated on every exchange.
Request
Responses
- 200
- 400
- 401
Access token issued
Invalid grant, missing parameter, or unsupported grant_type
Client authentication failed