generated: '2026-07-18'
method: searched
source: https://docs.hellobonsai.com/
docs: https://docs.hellobonsai.com/
description: >-
  Bonsai's programmatic surface (its hosted MCP server) authenticates with
  OAuth 2.1 authorization-code flow using PKCE, driven by the AI client. There
  are no API keys to create or paste; on first call the user is directed to Bonsai
  to log in, approves in the browser, and the client receives a short-lived token
  (~15 minutes, auto-refreshed) that is passed through to Bonsai without being
  stored by the MCP server. Access is scoped to the user's existing Bonsai role.
summary:
  types:
  - oauth2
  oauth2_flows:
  - authorizationCode
schemes:
- name: oauth2-pkce
  type: oauth2
  flows:
  - flow: authorizationCode
    pkce: true
    token_ttl_seconds: 900
    description: >-
      OAuth 2.1 authorization-code flow with PKCE, brokered by the AI client
      against Bonsai; MCP server passes the bearer token through without storage.
  sources:
  - https://docs.hellobonsai.com/
  - mcp/bonsai-mcp.yml