Begin an authorization (the person's browser)
response_type=code, client_id (an https metadata document URL, or a registered client), redirect_uri (registered), code_challenge + code_challenge_method=S256, state, scope (sessions or sessions:read), resource (<publicUrl>/mcp). Shows a consent page to the signed-in person; sends the browser back with code, state and iss. A client or redirect it can't accept gets a page, never a redirect.
client_id?stringredirect_uri?stringresponse_type?stringThe consent page
response?stringtext/htmlcurl -X GET 'http://127.0.0.1:7777/oauth/authorize?client_id=https%3A%2F%2Fclient.example%2Fmcp-client.json&redirect_uri=https%3A%2F%2Fclient.example%2Fcallback&response_type=code'"string"Authorization server metadata (RFC 8414) GET
Pistis is the authorization server for `/mcp`: authorization code with PKCE S256, Client ID Metadata Documents and dynamic registration, rotating refresh tokens, revocation. No token.
Exchange a code or a refresh token for tokens POST
`grant_type=authorization_code` (with `code`, `code_verifier`, `client_id`, `redirect_uri`, `resource`) or `grant_type=refresh_token` (with `refresh_token`, `client_id`; the refresh token rotates and a reuse revokes the family). Public clients (`token_endpoint_auth_method: none`).