generated: '2026-08-23'
method: searched
source: https://cola.melon.com/auth/v3/oauth/docs
sources:
- https://cola.melon.com/.well-known/oauth-authorization-server
- https://cola.melon.com/auth/v3/oauth/docs
- https://cola.melon.com/auth/v3/oauth/docs/dynamic-client-registration
- https://tech.kakaoent.com/ai/using-melon-mcp-server-en/
note: >-
  Kakao Entertainment publishes no OpenAPI, so this profile is not derived from securitySchemes. It is
  read from the provider's own RFC 8414 authorization server metadata document and from the Melon
  Alliance Auth v3 documentation pages, both fetched anonymously on 2026-08-23. Melon Alliance Auth v3
  describes itself as "a standards-compliant authorization platform that implements OAuth 2.0 and
  OAuth 2.1 (draft)".
platform:
  name: Melon Alliance Auth v3
  issuer: https://cola.melon.com
  documentation: https://cola.melon.com/auth/v3/oauth/docs
schemes:
- name: melon_oauth2
  type: oauth2
  flow: authorization_code
  pkce:
    required_by_metadata: true
    code_challenge_methods_supported:
    - S256
  authorization_endpoint: https://cola.melon.com/auth/v3/oauth/authorize
  token_endpoint: https://cola.melon.com/auth/v3/oauth/token
  introspection_endpoint: https://cola.melon.com/auth/v3/oauth/introspect
  revocation_endpoint: https://cola.melon.com/auth/v3/oauth/revoke
  registration_endpoint: https://cola.melon.com/auth/v3/oauth/register
  grant_types_supported:
  - authorization_code
  - refresh_token
  response_types_supported:
  - code
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  - client_secret_post
  scopes: scopes/kakao-entertainment-scopes.yml
  applies_to:
  - https://mcp.melon.com/mcp
dynamic_client_registration:
  supported: true
  spec: RFC 7591
  endpoint: https://cola.melon.com/auth/v3/oauth/register
  auth_methods_supported:
  - none
  documentation: https://cola.melon.com/auth/v3/oauth/docs/dynamic-client-registration
  request_fields:
  - name: client_name
    type: string
    required: true
    constraint: max 50 characters
  - name: redirect_uris
    type: string[]
    required: true
    constraint: max 5 URIs, each 300 characters or fewer
  response_fields:
  - client_id
  - client_secret
  - client_id_issued_at
  - client_secret_expires_at
  - client_name
  - redirect_uris
  - grant_types
  - response_types
  - token_endpoint_auth_method
  defaults:
    grant_types:
    - authorization_code
    - refresh_token
    response_types:
    - code
    token_endpoint_auth_method: client_secret_basic
    client_secret_expires_at: 0
  constraint: >-
    Registration is not open self-service. The provider states only redirect URIs allowlisted per
    partner are accepted and that malformed or disallowed redirect URIs are rejected; the MCP
    integration guide directs partners to melon_info@kakaoent.com to have their information registered
    before use.
security_considerations_published:
- client_secret must be kept confidential and never exposed to browser or frontend clients.
- Only per-partner allowlisted redirect URIs are accepted.
- All transport is HTTPS; the provider states authentication tokens are not stored on the MCP server.
- Provider recommends explicit user confirmation for critical actions and input sanitisation against
  prompt injection when building agent workflows.
ui_locales_supported:
- ko
x-evidence:
  fetched: '2026-08-23'
  metadata_url: https://cola.melon.com/.well-known/oauth-authorization-server
  metadata_status: 200
  docs_url: https://cola.melon.com/auth/v3/oauth/docs
  docs_status: 200
  dcr_docs_url: https://cola.melon.com/auth/v3/oauth/docs/dynamic-client-registration
  dcr_docs_status: 200