---
title: "Import OAuth tokens"
method: POST
path: "/projects/{projectId}/servers/{serverId}/oauth/import-tokens"
tags: ["OAuth"]
---

# Import OAuth tokens

`POST /projects/{projectId}/servers/{serverId}/oauth/import-tokens`

Stores OAuth tokens you obtained yourself (e.g. via the SDK's `runOAuthLogin` — interactive loopback, headless, or client-credentials) for this server, scoped to your user, project, and server. Subsequent API calls against the server inject the stored access token automatically, and `401`s from the server trigger a server-side refresh — no further caller involvement.

This closes the loop after an `OAUTH_REQUIRED` error.

## Path parameters

- `projectId` string, required
- `serverId` string, required

## Request body

- ImportTokensRequest
  - `serverUrl` string, required — The MCP server URL the tokens were obtained for.
  - `oauthResourceUrl` string — OAuth protected-resource URL, when it differs from `serverUrl`.
  - `clientInformation` object — OAuth client used to obtain the tokens. Optional, but without it server-side refresh cannot run — always include it when you provide a `refresh_token`.
    - `clientId` string, required
    - `clientSecret` string, password
  - `tokens` object, required
    - `access_token` string, password, required
    - `refresh_token` string, password
    - `expires_in` number — Seconds until the access token expires.
    - `token_type` string
    - `scope` string
    - `id_token` string, password

## Response `200`

Tokens stored.

- ImportTokensResult
  - `imported` true, required
  - `expiresAt` number, nullable — Epoch milliseconds when the stored access token expires, or `null` if unknown.

## Other responses

- `400` — Malformed body or parameters.
- `401` — Missing, invalid, revoked, or orphaned key (`UNAUTHORIZED`) — or the **target MCP server** needs an OAuth grant (`OAUTH_REQUIRED`), which is a property of the server, not your key.
- `403` — Key is valid but not allowed to do this.
- `404` — Unknown project, server, or resource.
- `429` — Per-key rate limit exceeded (60 requests/minute sustained, bursts up to 10). Honor `Retry-After` and back off with jitter.
- `500` — Something failed on MCPJam's side.
- `502` — Could not connect to the target MCP server.
- `504` — The target MCP server connected but didn't respond in time.

---

[API](https://skmtc.net/mcpjam/apis/mcpjam-api.md) · [All operations](https://skmtc.net/mcpjam/apis/mcpjam-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/mcpjam/mcpjam-api/revisions/ece7d99ceaf3/schema)