POST
/
api
/
oauth
/
token
curl -X POST https://api.costmcp.com/api/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code&code=...&client_id=cmcp_client_...&code_verifier=..."
Accepts application/x-www-form-urlencoded or application/json.

​
Authorization code grant

FieldRequired
grant_type=authorization_code✓
code✓
client_id✓
code_verifier✓
redirect_uriif used at authorize
client_secretconfidential clients

​
Refresh token grant

FieldRequired
grant_type=refresh_token✓
refresh_token✓
client_id✓
client_secretconfidential clients

​
Response

{
  "access_token": "cmcp_at_...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "cmcp_rt_...",
  "scope": "log_usage add_expenses read_summaries estimate_costs"
}
Errors use OAuth JSON: { "error", "error_description" }. 
curl -X POST https://api.costmcp.com/api/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code&code=...&client_id=cmcp_client_...&code_verifier=..."