Authentication

The MCP server authenticates with OAuth 2.1, Authorization Code + PKCE, and supports Dynamic Client Registration (RFC 7591) so a client never needs a manually-issued credential.

Endpoints

A client that discovers OAuth automatically only needs the server URL from the Quickstart. These are the underlying endpoints, for clients that need them directly:

https://ai.synup.com/api/oauth/well-known/oauth-protected-resource
https://ai.synup.com/api/oauth/well-known/oauth-authorization-server
https://ai.synup.com/oauth/mcp/register   (Dynamic Client Registration, RFC 7591)
https://ai.synup.com/oauth/mcp/authorize  (Authorization Code + PKCE)
https://ai.synup.com/oauth/mcp/token

Scopes

The consent screen grants one of two scopes for the whole connection:

There is no per-domain consent today — granting mcp:write gives a client write access to everything documented here, not just the domains it actually uses. Only authorize a client you trust with that scope.

Using the access token

Send the token your client received from the token endpoint as a Bearer token on every request:

Authorization: Bearer <access_token>

Revoking access

Revoke a connected client from Settings → Developer → MCP Connections at any time — this immediately blocks that client from getting a new access token.

Access tokens are short-lived (1 hour) and aren't individually checked against revocation — a token already issued to a client keeps working until it naturally expires, even right after you revoke.