MCP
MCP OAuth & discovery
The MCP server (/v1/mcp) is authenticated with a standards-based OAuth 2.0 flow, not an API key. Most MCP clients (Claude Desktop, Claude Code, Cursor, etc.) discover and drive this flow automatically — you generally won't call these endpoints directly.
Start with the discovery document rather than hardcoding endpoint paths — a compliant client always does.
Discovery
GET https://app.frameline.io/.well-known/oauth-authorization-server GET https://app.frameline.io/.well-known/oauth-protected-resource
The endpoints those documents describe:
| Param | Type | Notes |
|---|---|---|
| POST /oauth/register | RFC 7591 | Dynamic client registration. |
| GET /oauth/authorize | RFC 6749 | Starts the authorization request; redirects to sign-in/consent if needed. |
| POST /oauth/authorize/consent | Approves a pending client authorization. | |
| POST /oauth/authorize/deny | Denies a pending client authorization. | |
| POST /oauth/token | RFC 6749 | Token endpoint — authorization_code and refresh_token grants. |