OAuth 2.1 & the subscription gate
Every request to the MCP endpoint is authenticated with a short-lived bearer token and authorized against your live subscription. You never paste a token by hand — your MCP client runs the flow for you.
Discovery
On first use the client fetches the server's protected-resource metadata at /.well-known/oauth-protected-resource (RFC 9728), which names the authorization server. The client then reads the authorization-server metadata to find the authorize, token, and dynamic client registration endpoints.
Authorization flow
- Register — the client registers dynamically (DCR) if it has no client ID.
- Authorize — a browser window opens; you sign in and approve. Authorization code + PKCE.
- Token — the client exchanges the code for an access token (RS256 JWT, verified via JWKS).
- Call — the token is sent as
Authorization: Bearer …on every MCP request.
Scope & entitlement
Tokens carry the docs:read scope. On every call the server independently checks your live subscription server-side — it is never asserted by the client. With no active subscription the server returns 402 and tools do not run, even with a valid token.
| Layer | Enforced by |
|---|---|
| Valid, unexpired token (iss / aud / exp) | JWKS verification |
docs:read scope present | Scope check → 403 if missing |
| Active $150/mo subscription | Server-side entitlement → 402 if inactive |
| Fair-use request rate | Per-subject rate limit → 429 |
Re-authorizing
Access tokens expire; your client refreshes or re-runs the authorize flow automatically. If a tool returns 401, trigger any tool again to re-authorize. See Errors & limits.