API & MCP reference / MCP server
OAuth details
For anyone building their own MCP client: the server implements the MCP authorization spec, so a conforming client needs no Post-Train-specific code.
| Capability | Endpoint |
|---|---|
| Protected resource metadata (RFC 9728) | /.well-known/oauth-protected-resource |
| Authorization server metadata (RFC 8414) | /.well-known/oauth-authorization-server |
| Dynamic client registration (RFC 7591) | /api/oauth/mcp/register |
| Authorization | /oauth/authorize |
| Token | /api/oauth/mcp/token |
| Revocation (RFC 7009) | /api/oauth/mcp/revoke |
PKCE is mandatory and S256 is the only accepted method. Tokens are bound to a resource indicator (RFC 8707) and validated on every request, so a token minted for another server is rejected here even if it is otherwise valid. Refresh tokens rotate on use.