Skip to main content
The Tuteliq MCP server implements OAuth 2.1 with dynamic client registration (RFC 7591), PKCE with S256, and discovery via RFC 8414 and RFC 9728. Clients self-register. There is no manual credential exchange, and nothing to paste into a config file.

​
Discovery endpoints

An unauthenticated request to /mcp returns 401 with a WWW-Authenticate header pointing at the resource metadata, which is what starts the flow in a compliant client.

​
Token lifetime

Access tokens are valid for 30 days. Every token response carries expires_in and a refresh token, so a client renews without sending the user back through the browser.
Refresh tokens are valid for 90 days, so a client that idles for a month still reconnects without user interaction.

​
Refresh tokens rotate

Each refresh consumes the presented token and issues a new one. OAuth 2.1 requires this for public clients, which MCP clients are: they hold no client secret, as token_endpoint_auth_method: none advertises.
The response carries a fresh access_token, a fresh refresh_token, and expires_in. Store the new refresh token; the old one is spent.
A refresh token is single-use. Presenting one twice revokes every token descended from that grant, and the user must sign in again.This is deliberate. A replayed token means it either leaked or the client raced itself, and revoking only the replayed one would leave an attacker’s rotated successor working. Ending the whole family costs one re-authorisation and closes the access.
Failures return one message for unknown, expired, consumed and replayed tokens alike, since distinguishing them would tell an attacker which guess was once valid.

​
Static tokens, for headless environments

OAuth needs a browser, so a CI pipeline, cron job or container cannot complete it. Generate a token in the dashboard under Settings > Plugins and send it in the Authorization header.
A static token in a config file is a long-lived credential. Keep it out of version control, and prefer OAuth wherever a browser exists.

​
stdio, for clients without remote server support

Some clients only speak stdio. The npm package runs a local process that calls the same hosted API, so the tools are identical; only the transport and authentication differ.

​
Revoking access

Revoke a connection under Settings > Plugins in the dashboard. Revocation takes effect on the next request; there is no cached grant to wait out.

​
Sandbox

Create a sandbox key under Settings > API Keys > Environment: Sandbox to exercise tools without consuming credits. Sandbox responses are shaped identically to production, so integration code needs no branching.