Finalizes the consent flow atomically:
TablePerUserOAuthSession (24h Bifrost session token)TablePerUserOAuthCode (5-minute TTL, PKCE-bound)PendingFlowredirect_uri with code and stateThe MCP client then exchanges the code at /api/oauth/per-user/token.
Request body is application/x-www-form-urlencoded (browser form submission).
Bearer token authentication. Use your provider API key or Bifrost authentication token.
Virtual keys (prefixed with sk-bf-) can also be passed here.
Pending flow ID
Redirect to the MCP client's registered redirect_uri with
?code=xxx&state=yyy query parameters.