MCP server

OAuth reference

Endpoints and rules for developers building an MCP client.

ZieAds follows the MCP authorization spec. Clients that implement it, like Claude and ChatGPT, need nothing but the server URL.

Endpoint	URL
Protected resource metadata	`https://www.zieads.com/.well-known/oauth-protected-resource/mcp`
Authorization server metadata	`https://www.zieads.com/.well-known/oauth-authorization-server`
Registration (RFC 7591)	`https://www.zieads.com/api/oauth/register`
Authorization	`https://www.zieads.com/oauth/authorize`
Token	`https://www.zieads.com/api/oauth/token`
Revocation	`https://www.zieads.com/api/oauth/revoke`

Flow

A request without a token gets 401 and a WWW-Authenticate header with resource_metadata.
The client reads both metadata documents and registers itself.
The user is sent to /oauth/authorize with response_type=code, code_challenge (S256 only), state and scope (read, draft).
After Allow access the browser returns to the redirect URI with code, state and iss.
The client exchanges the code at the token endpoint with code_verifier. Codes last 10 minutes and work once.

Tokens

Token	Lifetime	Notes
Access token	1 hour	Send as Authorization: Bearer
Refresh token	90 days	Rotates on every use; reusing an old one fails

Redirect URIs must be https, http on localhost, or a custom app scheme. Public clients use token_endpoint_auth_method none; confidential clients may use client_secret_post or client_secret_basic.