Skip to main content
CaptureFlow runs its own OAuth 2.1 authorization server. MCP clients that follow the MCP authorization spec need nothing from this page: they discover everything from the metadata. Read on if you build your own client.

​
Endpoints

Protected resources (RFC 9728), one per audience: A 401 from a resource carries WWW-Authenticate: Bearer resource_metadata="...", the start of discovery.

​
Identify your app

Use an https URL as your client_id, pointing to a JSON document you host:
The document’s client_id must be its own URL, token_endpoint_auth_method must be none (no secret), with 1 to 10 redirect_uris. CaptureFlow fetches it (no redirects, 5 KB at most) and caches it for a day.

​
Authorization code flow

  1. Send the user to /oauth/authorize with response_type=code, client_id, redirect_uri, scope (space-separated scopes; unknown ones are ignored, and without any the app gets read-only access), state, code_challenge and code_challenge_method=S256, and resource (the resource you will call; the MCP server when omitted). PKCE with S256 is required.
  2. The user signs in to CaptureFlow, picks a default workspace and approves, possibly narrowing the scopes. CaptureFlow redirects back with code, state and iss (RFC 9207).
  3. Exchange the code at the token endpoint (form-encoded): grant_type=authorization_code, code, redirect_uri, code_verifier, client_id and the same resource. Codes last 10 minutes and work once.
The answer has an access_token (cfo_at_..., one hour), a refresh_token (cfo_rt_...) and the granted scope.

​
Refreshing

grant_type=refresh_token returns a new pair; refresh tokens rotate. A refresh token reused within 30 seconds of its rotation (a retried request) gets one more pair; any later reuse revokes the whole sign-in, as a stolen token would be. A refresh token unused for 30 days expires, and a sign-in lasts at most 180 days before the user approves again.

​
Revoking

POST /api/oauth/revoke with a token revokes the user’s whole sign-in with your app. Users can also disconnect your app in Settings > API & MCP > Connected apps.

​
Tokens are bound to a resource

A token works only for the resource it was issued for. A token for the MCP server also works on the read-only MCP server (with read scopes only); call the REST API with a token issued for https://api.captureflow.ai.