Skip to content
Loading…
Twelve Month

Authentication

Human sessions and agent access, clearly separated.

People use secure browser sessions. Every external agent and REST client uses Authorization Code with S256 PKCE and browser consent.

  1. 01

    Discover the resource and authorization server through their well-known metadata.

  2. 02

    Register an OAuth client with an exact redirect URI, then start authorization with S256 PKCE.

  3. 03

    Review and approve only the scopes the integration needs.

  4. 04

    Exchange the code and send the audience-bound OAuth access token to the API or MCP endpoint.