OAuth
How interactive clients authorize, what the scopes mean, token lifetimes, and the discovery endpoints.
Interactive MCP clients authenticate with OAuth 2.1: authorization code with PKCE (S256), plus dynamic client registration (RFC 7591) so a client needs no pre-provisioned credentials. You give the client the endpoint URL; the rest is discovery.
The flow
- The client requests
https://app.indexzero.site/mcpand receives a 401 with protected-resource metadata pointing at the authorization server. - It reads the authorization server metadata, registers itself, and sends you to the authorization endpoint in a browser.
- You sign in to IndexZero if needed and see a consent screen naming the client and the scopes it asked for. Approving binds the grant to the workspace you are signed in to.
- The client exchanges the code for an access token (and a refresh token if it asked for
offline_access) and starts calling tools.
Scopes
| Scope | Meaning |
|---|---|
mcp | Call IndexZero MCP tools on behalf of the authorizing workspace. Required on every grant; a token without it authenticates but reaches no tools. |
offline_access | Issue a refresh token so a long-running agent keeps working after the access token expires. |
A request whose token lacks mcp receives HTTP 403 with an insufficient_scope error and a hint to re-authorize.
Token lifetimes
| Token | Lifetime |
|---|---|
| Access token | 24 hours |
| Refresh token | 30 days |
| Dynamic client registration | 365 days |
A client that requested offline_access refreshes silently. One that did not will prompt you to approve again after 24 hours.
Discovery endpoints
All on the product origin, because the issuer and the resource live there:
| Document | URL |
|---|---|
| Authorization server metadata (RFC 8414) | https://app.indexzero.site/.well-known/oauth-authorization-server |
| Protected resource metadata (RFC 9728) | https://app.indexzero.site/.well-known/oauth-protected-resource |
| Authorization endpoint | https://app.indexzero.site/api/auth/oauth2/authorize |
| Token endpoint | https://app.indexzero.site/api/auth/oauth2/token |
| Registration endpoint | https://app.indexzero.site/api/auth/oauth2/register |
The marketing origin, indexzero.site, redirects the two well-known lookups here rather than serving copies, so a client that starts from the wrong hostname still validates against the canonical document.
Which workspace a grant reaches
A grant is bound to the workspace you were signed in to when you approved. Each person on a team approves separately and reaches their own workspace; a shared configuration file (a repository's .mcp.json, say) carries no credentials.
Revoking
Disconnect the client from the AI & MCP page in the app. Tokens stop working immediately; the client will prompt to authorize again the next time it is used.