Skip to main content

Exchange a PKCE code or rotate a refresh token

POST 
/api/v1/mcp/oauth/token

Session cookies and Authorization headers are refused. Credentials belong only to this MCP resource and operator REST namespace. Access tokens last 15 minutes. Rotating refresh tokens expire after 90 days of inactivity and never outlive a finite connection.

Request​

Responses​

Audience-bound access token; refresh token rotates when registered