How OAuth sign-in works for MCP clients, and the options you can add to the server URL.
#URL options
| Option | Effect |
|---|---|
?project_ref=<ref> | Only this project. Tools no longer need a project_ref argument. |
?read_only=true | Read-only, even with a read-write token or grant. |
?features=<groups> | Only these tool groups, comma separated: account, database, migrations, logs, advisors, functions, storage, development, docs, usage, monitoring (every read tool the monitoring prompts use) (also debugging = logs + advisors). Default: every group. An unknown group is an error. |
Example
https://stitchdb.com/platform/mcp?project_ref=abcdefghijklmnop&read_only=true&features=monitoring#OAuth flow
Clients discover everything from the server: an unauthenticated request returns 401 with a WWW-Authenticate header pointing to the protected resource metadata, which names the StitchDB authorization server.
| Endpoint | URL |
|---|---|
| Protected resource metadata | https://stitchdb.com/.well-known/oauth-protected-resource/platform/mcp |
| Authorization server metadata | https://stitchdb.com/.well-known/oauth-authorization-server |
| Dynamic client registration | https://stitchdb.com/platform/oauth/register |
| Authorization | https://stitchdb.com/platform/oauth/authorize |
| Token | https://stitchdb.com/platform/oauth/token |
| Revocation | https://stitchdb.com/platform/oauth/revoke |
- Authorization code flow with PKCE; only the
S256method is accepted, andstateis returned unchanged. - Redirect addresses must match a registered one exactly (loopback addresses of desktop apps may use any port).
- Access tokens last one hour. Refresh tokens last 30 days and are replaced on every use; reusing an old one ends the whole connection.
- Scopes:
mcp:readandmcp:write. What the app gets is what you choose on the consent screen.