> For the complete documentation index, see [llms.txt](https://docs.podigee.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.podigee.com/documentation/start-here/ai-agents/mcp-reference/oauth-discovery-and-authorization.md).

# OAuth discovery and authorization

OAuth metadata, public clients, PKCE, consent, resource binding, refresh, and revocation.

## Discovery sequence

1. Read the protected-resource metadata for the canonical MCP resource.
2. Read authorization-server metadata from the advertised issuer.
3. Use the advertised authorization endpoint, token endpoint, revocation endpoint, scopes, and PKCE methods.

The resource is `https://mcp.podigee.com/mcp`. The issuer is `https://app.podigee.com`.

## Authorization code flow

Podigee supports public OAuth clients with client authentication method `none`. Use authorization code flow with S256 PKCE. Bind the request to the exact resource, redirect URI, client, scopes, user, and selected Podigee account.

The consent screen shows the client identity, redirect host, account, and requested permissions. The authorization response includes issuer identification for MCP connector applications. Reject a missing, duplicate, or mismatched issuer before token exchange.

## Client registration

General dynamic client registration is not enabled. The pdg CLI uses its registered public client and exact loopback callback. First-party connector metadata must match the client record approved for that connector.

## Tokens

Send `Authorization: Bearer <token>`. Podigee accepts only credentials issued for the canonical MCP resource. It does not accept legacy API keys, the legacy `Token` header, generic OAuth tokens, or legacy personal access tokens.

Refresh tokens rotate. Reuse of a rotated token revokes the family. Revoking a connector grant invalidates the complete linked token family.

## Authorization failures

A missing, expired, revoked, or wrong-resource credential returns HTTP 401 with a `WWW-Authenticate` challenge and protected-resource metadata. Insufficient REST scope returns HTTP 403. MCP tool errors also provide authentication challenge metadata for compatible clients.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.podigee.com/documentation/start-here/ai-agents/mcp-reference/oauth-discovery-and-authorization.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.