> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lanesync.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Exchange PKCE code or rotate refresh token



## OpenAPI

````yaml /api-reference/openapi.json post /api/mcp/oauth/token
openapi: 3.1.0
info:
  title: LaneSync API
  description: >-
    REST API for LaneSync release governance — milestones, evidence, quality,
    and sync.
  version: 1.0.0
  contact:
    name: LaneSync
    url: https://lanesync.dev
servers:
  - url: https://lanesync.dev
    description: Hosted SaaS
security: []
tags:
  - name: Health
    description: Liveness and readiness
  - name: Auth
    description: GitHub OAuth and sessions
  - name: Dashboard
    description: Org-wide milestone views
  - name: Milestones
    description: Release pipeline and deploy gates
  - name: Repos
    description: Repository bootstrap and configuration
  - name: Sync
    description: GitHub sync triggers
  - name: Evidence
    description: CI evidence upload (no session)
  - name: Quality
    description: Quality scorecards and exports
  - name: Projects
    description: Multi-repo release projects
  - name: Team
    description: Workspace members and invites
  - name: Webhook
    description: GitHub App webhooks
  - name: Reviews
    description: Live evidence reviewer policy and eligibility
  - name: History
    description: Recorded shipped releases
  - name: MCP
    description: Remote MCP connection, OAuth, and personal keys
paths:
  /api/mcp/oauth/token:
    post:
      tags:
        - MCP
      summary: Exchange PKCE code or rotate refresh token
      operationId: mcpToken
      responses:
        '200':
          description: Short-lived MCP bearer and rotating refresh token
        '400':
          description: >-
            invalid_grant: expired, used, or mismatched grant; missing workspace
            membership; or invalid delegated GitHub credentials. Read
            error_description to distinguish restarting authorization from
            reconnecting GitHub.
        '403':
          description: >-
            access_denied: GitHub permission denied. Resolve missing access
            before retrying.
        '503':
          description: >-
            temporarily_unavailable: retry the same token request while the
            grant remains valid. GitHub throttling, outages, or failed token
            issuance do not consume the grant.
          headers:
            Retry-After:
              description: >-
                Suggested wait in seconds when GitHub throttles the request.
                This header is optional.
              schema:
                type: integer
                minimum: 1

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.