Skip to content
Twelve Month
Sign in

Authentication

Human sessions and agent access, clearly separated.

People use secure browser sessions. OAuth-capable agents use authorization-code access with S256 PKCE and browser consent; personal access tokens remain available for scripts and clients without OAuth.

  1. 01

    Discover the resource and authorization server through their well-known metadata.

  2. 02

    Register an OAuth client with an exact redirect URI, then start authorization with S256 PKCE.

  3. 03

    Review and approve only the scopes the integration needs.

  4. 04

    Exchange the code and send the audience-bound bearer token to the API or MCP endpoint.