Pistis
API referenceM C P

Authorization server metadata (RFC 8414)

GET
/.well-known/oauth-authorization-server

Pistis is the authorization server for /mcp: authorization code with PKCE S256, Client ID Metadata Documents and dynamic registration, rotating refresh tokens, revocation. No token.

Response Body

The metadata

application/json
  1. response
[key: string]?any
Example Request
curl -X GET 'http://127.0.0.1:7777/.well-known/oauth-authorization-server'
Example Response200
{}

Protected resource metadata for /mcp (RFC 9728) GET

Names `/mcp` as the resource and this server as its authorization server. Also at `/.well-known/oauth-protected-resource`. No token.

Begin an authorization (the person's browser) GET

`response_type=code`, `client_id` (an https metadata document URL, or a registered client), `redirect_uri` (registered), `code_challenge` + `code_challenge_method=S256`, `state`, `scope` (`sessions` or `sessions:read`), `resource` (`<publicUrl>/mcp`). Shows a consent page to the signed-in person; sends the browser back with `code`, `state` and `iss`. A client or redirect it can't accept gets a page, never a redirect.