Signing in
Signing in is OAuth, not a pasted token. If you are using Claude Code, Claude Desktop or claude.ai, the client does all of this for you — see the quickstart. This page is for anyone writing a client.
The handshake
| Step | What happens |
|---|---|
| 1 | POST /mcp with no token gets 401 and WWW-Authenticate: Bearer resource_metadata=... |
| 2 | /.well-known/oauth-protected-resource/mcp names the authorization server, https://api.pawsitivefuture.org/oauth |
| 3 | Register a client at /oauth/reg. Callbacks must be local or the client's own. |
| 4 | Authorize with PKCE (S256) and the resource parameter. The authorization-code flow only. |
| 5 | /oauth/token returns a 1-hour JWT access token and a 90-day refresh token that rotates on every use. |
| 6 | initialize opens a session. Send its Mcp-Session-Id on every request after. |
| 7 | A change sends elicitation/create mid-call; answer { "confirm": true } to proceed. See Reading and changing. |
The person signs in on the authorization server's own page: their work email, then a 6-digit code emailed to them.
What the token allows
The token is for the whole API, not only /mcp: it names the API's origin as its resource, so the
same token works on the REST endpoints. Every call re-enters the API with the token of the request
that carries it, so the route's own authentication, permission check and read scope decide —
exactly as for a portal request. A person sees and changes only what their grants allow.
Only platform accounts sign in here. A donor token is refused. There is no anonymous MCP surface:
an endpoint that is public over REST is not public over /mcp.
Ending access
Signing out ends the connection on its next call: POST /api/auth/logout, or an administrator
terminating the person's sessions. A refresh token that has been rotated cannot be reused.