Docs
OverviewGuidesZero & MCPAPI referenceChangelog
OAuth

Authorization Server Metadata

RFC 8414 metadata: authorization code with PKCE (S256 only), refresh tokens, dynamic registration of public clients, revocation. The issuer is `OAUTH_ISSUER_URL` (default: the first `WEB_BASE_URL`).

API key access

This route has its own authentication (or none); an API key is not used here.
GET/.well-known/oauth-authorization-server

Response Body

curl -X GET "http://localhost:8000/.well-known/oauth-authorization-server"
{
  "issuer": "string",
  "authorization_endpoint": "string",
  "token_endpoint": "string",
  "registration_endpoint": "string",
  "revocation_endpoint": "string",
  "response_types_supported": [
    "string"
  ],
  "response_modes_supported": [
    "string"
  ],
  "grant_types_supported": [
    "string"
  ],
  "token_endpoint_auth_methods_supported": [
    "string"
  ],
  "revocation_endpoint_auth_methods_supported": [
    "string"
  ],
  "code_challenge_methods_supported": [
    "string"
  ],
  "scopes_supported": [
    "string"
  ]
}
Empty

Mark Notification Read

Mark one notification read for the caller (idempotent: their first `read_at` stays). Read state is per member: a workspace-wide notification stays unread for the other members.

Authorize

The authorization endpoint (browser). A valid request is a 302 to the web app's consent screen (`/oauth/consent?request=<signed request>`, 10 minutes); an unknown client or redirect URI is a 302 to the consent screen with `error`; any other problem is a 302 back to the client's redirect URI with `error` and `state` (RFC 6749 §4.1.2.1).