---
title: "Exchange an authorization code or refresh token."
method: POST
path: "/mcp/oauth/token"
tags: ["MCP OAuth"]
---

# Exchange an authorization code or refresh token.

`POST /mcp/oauth/token`

Supports authorization_code with PKCE S256 and refresh_token with rotation.

## Request body

- union
  - object
    - `grant_type` 'authorization_code', required
    - `code` string, required
    - `redirect_uri` string, uri, required
    - `client_id` string, required
    - `code_verifier` string, required
    - `resource` string, uri
  - object
    - `grant_type` 'refresh_token', required
    - `refresh_token` string, required
    - `client_id` string, required
    - `scope` string
    - `resource` string, uri

## Response `200`

MCP OAuth token response.

- McpOAuthTokenResponse
  - `access_token` string, required — Short-lived JWT for `/api/v1/mcp`.
  - `token_type` 'Bearer', required
  - `expires_in` integer, required
  - `refresh_token` string, required — Opaque refresh token. Store securely; traxy stores only a hash.
  - `scope` string, required

## Other responses

- `400` — Request failed boundary validation.
- `401` — Invalid, expired, revoked, or wrong-audience MCP OAuth token. Response includes a WWW-Authenticate challenge with resource metadata.

---

[API](https://skmtc.net/windmill-growth/apis/traxy-customer-api-and-mcp-v1.md) · [All operations](https://skmtc.net/windmill-growth/apis/traxy-customer-api-and-mcp-v1/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/windmill-growth/traxy-customer-api-and-mcp-v1/revisions/5ea23c14f8cf/schema)