Spend an authorization code for an opaque access token and a refresh token. The access token is
Mcp oauth
Spend an authorization code for an opaque access token and a refresh token. The access token is
not a session token and reaches no data on its own: only api.exchange_mcp_token, called by the MCP server with the tenant’s own key beside it, turns one into a session.

