MCP and OAuth
MCP server: POST https://clarity.whooho.it/api/mcp (Streamable HTTP, JSON responses). Protocol versions 2025-11-25, 2025-06-18, 2025-03-26, 2024-11-05. Methods: initialize, ping, tools/list, tools/call. All tools are readOnlyHint: true. Without credentials it returns 401 with WWW-Authenticate and resource_metadata.
OAuth 2.1
| Item | Value |
|---|---|
| Resource metadata | /.well-known/oauth-protected-resource |
| Server metadata | /.well-known/oauth-authorization-server |
| Dynamic registration (RFC 7591) | POST /api/oauth/register |
| Authorization | GET /oauth/authorize — response_type=code, PKCE S256 required |
| Token | POST /api/oauth/token — authorization_code, refresh_token |
| Revocation | POST /api/oauth/revoke |
Single-use codes (10 minutes), exact redirect_uri match, 1-hour access tokens, 30-day rotating refresh tokens; reuse of a code or refresh token revokes the whole connection.