Skip to content

OAuth

Connection methods

The server accepts one of: MCP token (Bearer or ?token=), OAuth 2.0 (pre-registered client), or OAuth 2.0 + Dynamic Client Registration (RFC 7591 via POST /oauth/register). Only one credential type is required per request.

OAuth 2.0 Endpoints

Authorization

Endpoint: GET /oauth/authorize

Initiates the OAuth 2.0 authorization flow.

Query Parameters: - client_id (required): Client ID - redirect_uri (required): Redirect URI - response_type (required): Response type (must be "code") - scope (optional): Requested scopes - state (optional): State to prevent CSRF

Token

Endpoint: POST /oauth/token

Exchanges authorization code for access token.

Body (application/x-www-form-urlencoded): - grant_type: "authorization_code" - code: Authorization code - redirect_uri: Redirect URI - client_id: Client ID - client_secret: Client secret

HTTP Status Codes

  • 200 OK: Successful request
  • 400 Bad Request: Invalid parameters
  • 401 Unauthorized: Not authenticated
  • 403 Forbidden: Not authorized
  • 404 Not Found: Resource not found
  • 500 Internal Server Error: Server error

Error Handling

Error responses follow this format:

{
  "error": "Descriptive error message",
  "content": [
    {
      "type": "text",
      "text": "Error: Descriptive error message"
    }
  ],
  "isError": true
}

Rate Limiting

Currently no rate limits are configured, but they are recommended for production.

API Version

The current API version is 1.0.1. Important changes will be documented in release notes.