OAuth for apps
Let users connect your app or agent to their Resolido workspace with OAuth 2.1.
MCP clients discover all of this automatically. Read on if you build your own integration.
Resolido is an OAuth 2.1 authorization server for public clients:
| Setting | Value |
|---|---|
| Metadata (RFC 8414) | https://www.resolido.com/.well-known/oauth-authorization-server |
| Protected resources (RFC 9728) | https://mcp.resolido.com/.well-known/oauth-protected-resource, https://api.resolido.com/.well-known/oauth-protected-resource |
| Authorization endpoint | https://www.resolido.com/oauth/authorize |
| Token endpoint | https://www.resolido.com/oauth/token |
| Revocation (RFC 7009) | https://www.resolido.com/oauth/revoke |
| Grant types | authorization_code with PKCE S256 (required), refresh_token |
| Client authentication | none (public clients) |
Registering a client
Use either:
- Client ID Metadata Documents – your
client_idis an HTTPS URL that serves a JSON document withclient_nameandredirect_uris. Nothing to register. - Dynamic client registration (RFC 7591) –
POST /oauth/registerwithclient_nameandredirect_uris.
Redirect URIs must be HTTPS, a loopback address (http://127.0.0.1:<any port>/…, the port may change between requests) or a private-use scheme (com.example.app:/callback) for native apps.
Flow
- Redirect the user to the authorization endpoint with
response_type=code,client_id,redirect_uri,state,code_challengeandcode_challenge_method=S256. Optionally passscope(space-separated) to preselect the access level andresource(the MCP or API URL). - The user signs in, picks one organization and a preset, and approves. You receive
code,stateandisson the redirect URI. - Exchange the code (valid 10 minutes, single use) at the token endpoint with
grant_type=authorization_codeand yourcode_verifier.
{
"access_token": "rsl_oat_…",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": "rsl_ort_…",
"scope": "conversations:read conversations:write …"
}- Refresh with
grant_type=refresh_token. Each refresh returns a new refresh token; reusing an old one revokes the whole grant. - When the user disconnects, revoke the refresh token at the revocation endpoint.