# OAuth token endpoint

Exchanges an authorization code for access/refresh tokens (with `code_verifier` when the code was issued with PKCE), or rotates refresh tokens. Supports `authorization_code` and `refresh_token` grants. Referenced by `components.securitySchemes.oauth2` for MCP and OpenAPI OAuth clients.

Endpoint: POST /v1/oauth/token
Version: 1.0.0

## Request fields (application/json):

  - `grant_type` (string, required)
    Enum: "authorization_code", "refresh_token"

  - `code` (string)

  - `redirect_uri` (string)

  - `code_verifier` (string)

  - `refresh_token` (string)

  - `scope` (string)

  - `client_id` (string)

  - `client_secret` (string)

## Response 200:

  - `200` (unknown)
    OAuth access token response

## Response 200 fields (application/json):

  - `access_token` (string, required)

  - `token_type` (string, required)
    Enum: "Bearer"

  - `expires_in` (integer, required)

  - `refresh_token` (string, required)

  - `scope` (string, required)

## Response 400:

  - `400` (unknown)
    OAuth token request failed (invalid_grant, invalid_scope, unsupported_grant_type)

## Response 400 fields (application/json):

  - `error` (string, required)

  - `error_description` (string)

## Response 401:

  - `401` (unknown)
    Client authentication failed

## Response 401 fields (application/json):

  - `error` (string, required)

  - `error_description` (string)

## Response 429:

  - `429` (unknown)
    IP rate limit exceeded