OAuth 2.1, scopes and tokens
Discovery metadata, dynamic registration, PKCE, read, write and send scopes, token lifetimes and revocation.
The server follows the MCP authorization spec: OAuth 2.1 with mandatory PKCE, protected resource metadata (RFC 9728), authorization server metadata (RFC 8414), dynamic registration (RFC 7591) and the iss response parameter (RFC 9207).
Discovery
GET https://mcp.novadesko.com/.well-known/oauth-protected-resource
GET https://mcp.novadesko.com/.well-known/oauth-authorization-server| Field | Value |
|---|---|
resource | https://mcp.novadesko.com (or https://mcp.novadesko.com/mcp depending on the address called) |
issuer | https://mcp.novadesko.com |
authorization_endpoint | https://web.novadesko.com/ai-oauth/authorize |
token_endpoint | https://mcp.novadesko.com/ai-oauth/token |
registration_endpoint | https://mcp.novadesko.com/ai-oauth/register |
revocation_endpoint | https://mcp.novadesko.com/ai-oauth/revoke |
grant_types_supported | authorization_code, refresh_token |
code_challenge_methods_supported | S256 |
token_endpoint_auth_methods_supported | none, client_secret_post, client_secret_basic |
scopes_supported | read, write, send |
authorization_response_iss_parameter_supported | true |
The authorization screen stays on web.novadesko.com: it uses the user's Novadesko session. A call without a token to https://mcp.novadesko.com returns:
HTTP/2 401
www-authenticate: Bearer resource_metadata="https://mcp.novadesko.com/.well-known/oauth-protected-resource", scope="read write send"Dynamic registration
POST https://mcp.novadesko.com/ai-oauth/register
Content-Type: application/json
{
"client_name": "My MCP client",
"redirect_uris": [
"https://client.example/callback"
],
"token_endpoint_auth_method": "none",
"grant_types": [
"authorization_code",
"refresh_token"
],
"response_types": [
"code"
]
}- 1 to 10
redirect_uris, 500 characters max, no#fragment. - HTTPS required, except
http://localhost,127.0.0.1and[::1]for local clients. - The response holds the
client_id(prefixndcl_). Any secret is stored hashed (SHA-256).
Scopes
| Scope | Novadesko screen | Visible tools |
|---|---|---|
read | Read (always granted) | get_*, search*, list_*, fetch, cancel_action |
write | Create and edit (optional) | write-scope prepare_* tools + confirm_action |
send | Send emails and SMS (optional) | prepare_email, prepare_reminder + confirm_action |
The user can untick write or send on the authorization screen, whatever the client asks for. tools/list only returns the tools allowed by the granted scopes.
Token lifetimes
| Item | Lifetime |
|---|---|
| Authorization code | 10 minutes, single use |
| Access token | 1 hour |
| Refresh token | 30 days, renewed on each refresh (rotation) |
Revocation
The client can revoke with POST https://mcp.novadesko.com/ai-oauth/revoke (RFC 7009). The user can also click Revoke in Novadesko, Integrations: the effect is immediate and the next call gets 401. All secrets (tokens, codes) are stored hashed, never in clear text.