OAuth-Tokens tauschen oder aktualisieren
Tauscht einen Authorization Code gegen Tokens ein oder aktualisiert ein bestehendes Token-Paar. Der Endpunkt akzeptiert application/x-www-form-urlencoded, application/json oder unformatierte form-kodierte Payloads.
curl -X POST "https://api.example.com/mcp-server/token" \
-H "Content-Type: application/json" \
-d '{
"grant_type": "authorization_code",
"code": "mcp_code_example_1234567890abcdef",
"redirect_uri": "https://client.example.app/callback",
"client_id": "mcp_client_example_1234567890abcdef",
"code_verifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
}'
import requests
import json
url = "https://api.example.com/mcp-server/token"
headers = {
"Content-Type": "application/json"
}
data = {
"grant_type": "authorization_code",
"code": "mcp_code_example_1234567890abcdef",
"redirect_uri": "https://client.example.app/callback",
"client_id": "mcp_client_example_1234567890abcdef",
"code_verifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
}
response = requests.post(url, headers=headers, json=data)
print(response.json())
const response = await fetch("https://api.example.com/mcp-server/token", {
method: "POST",
headers: {
"Content-Type": "application/json"
},
body: JSON.stringify({
"grant_type": "authorization_code",
"code": "mcp_code_example_1234567890abcdef",
"redirect_uri": "https://client.example.app/callback",
"client_id": "mcp_client_example_1234567890abcdef",
"code_verifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
})
});
const data = await response.json();
console.log(data);
package main
import (
"fmt"
"net/http"
"bytes"
"encoding/json"
)
func main() {
data := []byte(`{
"grant_type": "authorization_code",
"code": "mcp_code_example_1234567890abcdef",
"redirect_uri": "https://client.example.app/callback",
"client_id": "mcp_client_example_1234567890abcdef",
"code_verifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
}`)
req, err := http.NewRequest("POST", "https://api.example.com/mcp-server/token", bytes.NewBuffer(data))
if err != nil {
panic(err)
}
req.Header.Set("Content-Type", "application/json")
client := &http.Client{}
resp, err := client.Do(req)
if err != nil {
panic(err)
}
defer resp.Body.Close()
fmt.Println("Response Status:", resp.Status)
}
require 'net/http'
require 'json'
uri = URI('https://api.example.com/mcp-server/token')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
request = Net::HTTP::Post.new(uri)
request['Content-Type'] = 'application/json'
request.body = '{
"grant_type": "authorization_code",
"code": "mcp_code_example_1234567890abcdef",
"redirect_uri": "https://client.example.app/callback",
"client_id": "mcp_client_example_1234567890abcdef",
"code_verifier": "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"
}'
response = http.request(request)
puts response.body
{
"access_token": "mcp_at_example_1234567890abcdef",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": "mcp_rt_example_rotated_abcdef1234567890",
"scope": "mcp"
}
{
"error": "invalid_grant",
"error_description": "The authorization code or refresh token is invalid or expired."
}
{
"error": "unsupported_grant_type",
"error_description": "The specified grant_type is not supported."
}
{
"code": 500,
"message": "Internal server error"
}
/token
Target server for requests. Edit to use your own host.
The media type of the request body
OAuth-Grant-Typ.
Authorization Code für den Authorization-Code-Grant.
Redirect-URI aus der ursprünglichen Autorisierungsanfrage.
Registrierte OAuth-Client-Kennung.
PKCE-Code-Verifier, erforderlich wenn eine Code-Challenge gesetzt wurde.
Refresh Token für den Refresh-Token-Grant.
Request Preview
Response
Response will appear here after sending the request
Body
Authorization Code für den Authorization-Code-Grant.
mcp_code_example_1234567890abcdefRedirect-URI aus der ursprünglichen Autorisierungsanfrage.
https://client.example.app/callbackPKCE-Code-Verifier, erforderlich wenn eine Code-Challenge gesetzt wurde.
dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXkRefresh Token für den Refresh-Token-Grant.
mcp_rt_example_1234567890abcdefResponses
OAuth-Access-Token mit einer Gültigkeit von 1 Stunde.
Bearer-Token-Typ.
BearerLebensdauer des Access Tokens in Sekunden.
Refresh Token mit einer Gültigkeit von 30 Tagen.
Gewährter Scope.