OAuth 2.1 server

Make your project an OAuth 2.1 / OpenID Connect provider so other apps — and AI agents through MCP — can sign in with your users.

#Turn it on

In Studio → Authentication → URL configuration → OAuth 2.1 server, enable the server and set the path of your consent page (default /oauth/consent, on your Site URL). Clients discover everything at:

Text

https://&lt;project-ref&gt;.p.stitchdb.com/auth/v1/.well-known/oauth-authorization-server
https://&lt;project-ref&gt;.p.stitchdb.com/auth/v1/.well-known/openid-configuration

#Clients

Register clients with the admin API (POST /auth/v1/admin/oauth/clients with the service_role key), or turn on dynamic client registration so apps register themselves (POST /auth/v1/oauth/clients/register, RFC 7591) — handy for MCP clients. Only the redirect URIs a client registered are accepted.

#Flow

The client sends the user to https://<project-ref>.p.stitchdb.com/auth/v1/oauth/authorize (authorization code + PKCE).
Auth sends the user to your consent page with an authorization_id. Your page (signed-in user) shows what the client asks for and approves or denies it through the Auth API.
The client exchanges the code at /auth/v1/oauth/token and gets an access token (a JWT of your project, so your RLS policies apply) and a refresh token; /auth/v1/oauth/userinfo returns the user's profile.