MCP OAuth token endpoint proxy (authorization_code + refresh_token)

POST

/oauth/token

curl --request POST \
  --url https://example.com/api/oauth/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=refresh_token \
  --data refresh_token=example \
  --data client_id=2489E9AD-2EE2-8E00-8EC9-32D5F69181C0 \
  --data resource=https://example.com

• AppHandoff API

Forwards authorization_code and refresh_token grants to Supabase /auth/v1/oauth/token. Discovered as token_endpoint from /.well-known/oauth-authorization-server for MCP clients.

Accepts both application/x-www-form-urlencoded (OAuth 2.1 standard) and application/json request bodies.

RFC 8707 (Resource Indicators): clients MAY include an optional resource parameter. When present, the value must equal the canonical API base URL (case-insensitive scheme/host; trailing slash tolerated); mismatches return invalid_target (HTTP 400). The value is forwarded upstream so future Supabase versions that honor RFC 8707 populate the JWT aud claim.

Request Body ^required

One of:

object

object

grant_type

required

string

Allowed values: refresh_token

refresh_token

required

string

client_id

required

string format: uuid

resource

RFC 8707 resource indicator. Optional; when provided, must equal the canonical API base URL (case-insensitive scheme/host; trailing slash tolerated). Mismatch returns invalid_target.

string format: uri

<= 512 characters

object

object

grant_type

required

string

Allowed values: authorization_code

code

required

string

client_id

required

string format: uuid

redirect_uri

required

Must be https://, http://localhost/127.0.0.1/[::1], or a registered custom app scheme. javascript:, data:, file:, vbscript: are denylisted.

string

code_verifier

required

PKCE verifier; the AS metadata advertises S256-only.

string

>= 43 characters <= 128 characters

resource

RFC 8707 resource indicator (see refresh_token grant).

string format: uri

<= 512 characters

One of:

object

object

grant_type

required

string

Allowed values: refresh_token

refresh_token

required

string

client_id

required

string format: uuid

resource

RFC 8707 resource indicator. Optional; when provided, must equal the canonical API base URL (case-insensitive scheme/host; trailing slash tolerated). Mismatch returns invalid_target.

string format: uri

<= 512 characters

object

object

grant_type

required

string

Allowed values: authorization_code

code

required

string

client_id

required

string format: uuid

redirect_uri

required

Must be https://, http://localhost/127.0.0.1/[::1], or a registered custom app scheme. javascript:, data:, file:, vbscript: are denylisted.

string

code_verifier

required

PKCE verifier; the AS metadata advertises S256-only.

string

>= 43 characters <= 128 characters

resource

RFC 8707 resource indicator (see refresh_token grant).

string format: uri

<= 512 characters

Responses

200

Token payload from Supabase

Media type application/json

object

400

Invalid request. Error codes:

• INVALID_BODY — schema validation failure
• INVALID_RESOURCE — resource parameter does not match canonical API URL

Media type application/json

object

error

required

Human-readable error message

string

code

Stable machine-readable error code for client branching

string

fieldErrors

First validation message per field path

object

key

additional properties

string

issues

Structured validation issues (Zod)

Array<object>

object

path

required

string

message

required

string

retryAfter

Seconds until rate limit resets (429 responses)

number

429

Rate limited

Media type application/json

object

error

required

Human-readable error message

string

code

Stable machine-readable error code for client branching

string

fieldErrors

First validation message per field path

object

key

additional properties

string

issues

Structured validation issues (Zod)

Array<object>

object

path

required

string

message

required

string

retryAfter

Seconds until rate limit resets (429 responses)

number

retryAfter

Seconds until the rate limit resets

number

Headers

Retry-After

string

500

Server error

Media type application/json

object

error

required

Human-readable error message

string

code

Stable machine-readable error code for client branching

string

fieldErrors

First validation message per field path

object

key

additional properties

string

issues

Structured validation issues (Zod)

Array<object>

object

path

required

string

message

required

string

retryAfter

Seconds until rate limit resets (429 responses)

number

502

Upstream Supabase token exchange error

Media type application/json

object

error

required

Human-readable error message

string

code

Stable machine-readable error code for client branching

string

fieldErrors

First validation message per field path

object

key

additional properties

string

issues

Structured validation issues (Zod)

Array<object>

object

path

required

string

message

required

string

retryAfter

Seconds until rate limit resets (429 responses)

number