---
title: "Exchange OAuth code for MCP tokens"
method: POST
path: "/api/mcp/oauth/callback"
tags: ["v2", "mcp", "mcp"]
---

# Exchange OAuth code for MCP tokens

`POST /api/mcp/oauth/callback`

Exchange the authorization code for tokens and store the credential.

The frontend calls this after receiving the OAuth code from the popup.
On success, subsequent ``/discover-tools`` calls for the same server URL
will automatically use the stored credential.

## Request body

- MCPOAuthCallbackRequest — Request to exchange an OAuth code for tokens.
  - `code` string, required — Authorization code from OAuth callback
  - `state_token` string, required — State token for CSRF verification

## Response `200`

Successful Response

- CredentialsMetaResponse
  - `id` string, required
  - `provider` string, required
  - `type` 'api_key' | 'oauth2' | 'user_password' | 'host_scoped', required
  - `title` string, nullable, required
  - `scopes` string[], nullable, required
  - `username` string, nullable, required
  - `host` string, nullable — Host pattern for host-scoped or MCP server URL for MCP credentials
  - `is_managed` boolean

## Other responses

- `401` — Authentication required
- `422` — Validation Error

---

[API](https://skmtc.net/significant-gravitas/apis/autogpt-agent-server.md) · [All operations](https://skmtc.net/significant-gravitas/apis/autogpt-agent-server/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/significant-gravitas/autogpt-agent-server/versions/382041c7ecb2/schema)