OAuth

Unauthenticated. The document a client is pointed at by WWW-Authenticate on a 401 from /mcp, and the first step of the whole flow. scopes_supported names the minimal set for basic functionality — a client asks for more through a step-up rather than being nudged into requesting everything at once.

Unauthenticated. Advertises S256 as the only PKCE method — plain is in RFC 7636 and provides no protection against the code interception PKCE exists for — and authorization_response_iss_parameter_supported, because this server emits iss (RFC 9207) and a strict client will not check it otherwise.

Unauthenticated at this step. Validates the request and redirects to the SPA consent screen at /authorize carrying the parameters; it does not render HTML, because this application serves one index.html and a server-rendered consent page would be the only thing that could drift from the app's own styling.

Failures concerning the redirect target itself are reported directly rather than bounced off it — an unvalidated redirect_uri is an open redirect and must not be used to deliver its own error. redirect_uri is matched exactly against one the client registered; a prefix match here would hand somebody else an authorization code.

PKCE is required and code_challenge_method must be S256.

Unauthenticated (public clients, token_endpoint_auth_method: none); form-encoded, as the RFC requires. Grants: authorization_code and refresh_token.

The code is single use, taken with DELETE … RETURNING so two simultaneous redemptions cannot both succeed. It is bound to the client, the redirect, the PKCE challenge and the resource — every one of those is re-checked here.

A refresh rotates both secrets, so a leaked access token stops working as soon as the legitimate client refreshes. Access credentials live 24 hours.

Unauthenticated by design: this hands out an identifier and nothing else. Every client is public, there is no secret, and possession of a client_id gets you as far as an authorization request that a logged-in human then has to approve by hand.

redirect_uris must be https, a loopback http address, or a private-use scheme. Plain http anywhere else would put an authorization code on the network in the clear.

Session-only. Scope descriptions travel with it rather than raw scope strings — listening:read is not something a person can consent to. verified says whether the client identified itself with a fetchable URL or merely registered a name it chose for itself; the consent screen warns on the latter.

Session-only, and that is the load-bearing part of the whole flow: minting a credential requires a logged-in human on this instance. Everything before this point is a request; this is the consent.

redirect_uri is re-checked here rather than trusted from the browser — this handler is reachable directly. The resource must name this server, or RFC 8707's audience binding would record an audience and enforce nothing. The response carries iss (RFC 9207) in the redirect.