OAuth
Authorize MCP and third-party clients.
TraceGuard is an OAuth 2.0 authorization server, used primarily to authorize MCP clients (and other third-party apps) without handing them a long-lived token.
Discovery
The server publishes standard authorization-server metadata at:
https://app.traceguard.io/.well-known/oauth-authorization-serverMCP clients derive this URL automatically from the server's resource URI, so in most cases you don't configure anything — you just approve the sign-in.
Endpoints
| Endpoint | Purpose |
|---|---|
/.well-known/oauth-authorization-server | Authorization-server metadata. |
/oauth/register | Dynamic Client Registration (RFC 7591). |
/oauth/authorize | Authorization (user consent). |
/oauth/token | Token exchange. |
Flow
- The client fetches the metadata and dynamically registers itself at
/oauth/register. - It sends you to
/oauth/authorizeto sign in and consent to the scopes it requests. - It exchanges the resulting code at
/oauth/tokenfor an access token. - It calls the MCP server (or API) with that token as a bearer credential.
Scopes use the same resource:action permission model as
tokens and roles, and the issued token
can never exceed your own authority.
For a headless integration that can't do an interactive OAuth flow, mint a
static MCP token (tgm_…) instead and skip straight to bearer auth.