OAuth for MCP.
Discovery, PKCE, tokens and access revocation.
Deployment addresses
- MCP resource:
https://ctx4.me/mcp. - Resource discovery.
- OAuth discovery.
Obtain full authorize, token, register and revoke addresses from this deployment's discovery. The server returns consent and provider authorization URLs: do not construct them manually from examples.
Public routes
| Method and path | Purpose | Input and result |
|---|---|---|
GET https://ctx4.me/.well-known/oauth-protected-resource/mcp | Resource discovery | Metadata with authorization server and MCP resource |
GET https://ctx4.me/.well-known/oauth-authorization-server | OAuth discovery | Endpoint URLs, scope and supported grants |
POST https://ctx4.me/oauth/register | Client registration | JSON with redirect URIs; client ID, public client without a secret |
GET https://ctx4.me/oauth/authorize | Start authorization code flow | Query client_id, redirect_uri, response_type=code, scope=mcp:tools, resource, code_challenge, code_challenge_method=S256, state; browser redirect |
GET https://ctx4.me/oauth/consent | Approval page | Continue browser consent in the selected workspace |
POST https://ctx4.me/oauth/token | Code exchange and refresh | Form-urlencoded; tokens and expiry |
POST https://ctx4.me/oauth/revoke | Revoke token family | Form-urlencoded token: access or refresh token |
POST https://ctx4.me/mcp, GET https://ctx4.me/mcp, DELETE https://ctx4.me/mcp | MCP resource | MCP messages and lifecycle, bearer access token |
The client builds URLs from discovery. Do not invent an authorization URL from an example. This deployment's resource is https://ctx4.me/mcp; public clients require a reachable HTTPS address. A public client uses token_endpoint_auth_method=none and PKCE S256.
Registration and redirects
A redirect URI must exactly match a registered URI. HTTPS and native-client loopback callbacks are permitted. Wildcards, fragments, URL credentials and non-loopback HTTP are rejected. The public MCP resource must have a stable HTTPS address.
Code exchange
grant_type=authorization_code requires code, client_id, redirect_uri, code_verifier, resource. The code verifier is a string of 43–128 characters. The code is single-use and valid for five minutes. grant_type=refresh_token requires refresh_token, client_id, resource.
An access token is opaque and valid for 15 minutes. The refresh token rotates on refresh; the family lifetime is 30 days. Reuse of a consumed refresh token revokes the family. Store the latest refresh token atomically.
OAuth errors use {error, error_description}, rather than the general Problem API; token responses are not cached. A consent or code-exchange error must not be bypassed by repeating a provider write.
What a grant permits
A grant provides workspace MCP access while preserving existing permissions and restrictions. It does not create a new provider account. An existing active connection may be reused; when several exist, the agent asks you to choose.
Every OAuth MCP request checks current membership and workspace state. Token revocation, member removal, changes to the membership epoch, workspace archival and grant expiry end access. Revoking MCP OAuth is distinct from revoking provider credentials: access chapter.