KrexelDocsHome

OAuth implementer reference

Standard MCP hosts should start from the public resource URL and use discovery:

https://krexel.com/api/mcp

Do not hardcode protocol endpoints when the discovery documents provide them.

Discovery

Protected resource:
https://krexel.com/.well-known/oauth-protected-resource/api/mcp

Authorization server:
https://krexel.com/.well-known/oauth-authorization-server

JWKS:
https://krexel.com/.well-known/jwks.json

The protected-resource document is authoritative for the resource value. Echo that exact value through authorization and token exchange.

Client registration

Krexel supports RFC 7591 dynamic client registration:

POST https://krexel.com/oauth/register
Content-Type: application/json

Public clients should use token_endpoint_auth_method: "none" with PKCE. Krexel does not currently advertise Client ID Metadata Document support.

The dashboard's manual client-registration page is only for developers who own the application and its callback URL. ChatGPT and other standard MCP hosts must self-register.

Authorization

Use authorization code with:

  • PKCE S256;
  • the exact registered redirect URI;
  • scope=krexel.mcp;
  • the protected-resource metadata's exact resource value;
  • an unguessable state value.

The user signs in and approves access at Krexel. Never collect a Krexel password, dashboard cookie, or customer API key in the client.

Tokens

Exchange codes and refresh tokens at the discovered token endpoint. Access tokens are RS256 JWTs whose:

  • issuer is https://krexel.com;
  • audience is https://krexel.com/api/mcp;
  • scope is krexel.mcp.

Send the access token only to the MCP resource as:

Authorization: Bearer <access-token>

MCP tokens do not authorize account REST APIs.

Lifecycle

Use the discovered revocation and introspection endpoints. Refresh tokens rotate; discard the previous refresh token after a successful exchange. Reconnect when the MCP endpoint returns a 401 challenge.

For customer setup, see Connect a remote AI with OAuth.