OAuth details
Endpoints, flow, tokens and scopes for MCP clients that sign in to https://corpole.com/api/mcp on their own.
Endpoints and flow
| Item | Value |
|---|---|
| Protected resource metadata | /.well-known/oauth-protected-resource/api/mcp (RFC 9728) |
| Authorization server metadata | /.well-known/oauth-authorization-server (RFC 8414) |
| Client registration | Dynamic (POST /api/oauth/register, RFC 7591) or Client ID Metadata Documents (an https client_id) |
| Flow | Authorization code with PKCE S256 (required); public clients |
| Redirect URIs | https, or http on a loopback address (any port) |
| Tokens | Access 1 hour, refresh 30 days with rotation; reusing a code or a refresh token revokes the connection |
| Revocation | POST /api/oauth/revoke (RFC 7009), or Disconnect on the project's Agents page |
Scopes
| Scope | Allows |
|---|---|
read | Read the project's records, work, knowledge and standards. Always granted. |
propose | Add Drafts, change proposals, work items, tests, results, questions, decisions, defects and risks for people to review. Never makes anything binding. |
The permissions are chosen on the consent screen; propose needs a role above viewer. A connection never has more permissions than the person who approved it.