generated: '2026-08-17'
method: searched
source: https://mcp.kotzilla.io/.well-known/oauth-authorization-server
docs:
  - https://doc.kotzilla.io/docs/getstartedCustom/mcpSetup
  - https://doc.kotzilla.io/docs/getstartedCustom/consoleSetup
  - https://doc.kotzilla.io/docs/settings/projectFile
note: >-
  Authored from the provider's own RFC 8414 / RFC 9728 metadata documents and
  setup docs, NOT derived from an OpenAPI — Kotzilla publishes no OpenAPI
  (see mcp/kotzilla-mcp.yml). Kotzilla runs two distinct authentication
  surfaces: OAuth 2.1 on the MCP server for agents/humans, and an API-key model
  for SDK telemetry ingestion from the instrumented app.

summary:
  types: [oauth2, apiKey]
  api_key_in: [config-file]
  oauth2_flows: [authorizationCode]
  pkce_required: true
  dynamic_client_registration: true

schemes:
  - name: KotzillaMCPOAuth
    type: oauth2
    surface: https://mcp.kotzilla.io/mcp
    description: >-
      OAuth 2.0 authorization-code flow with PKCE protecting the Kotzilla MCP
      Server. Advertised anonymously at
      https://mcp.kotzilla.io/.well-known/oauth-authorization-server. The MCP
      server is both the resource server and its own authorization server.
    flows:
      - flow: authorizationCode
        authorizationUrl: https://mcp.kotzilla.io/oauth/authorize
        tokenUrl: https://mcp.kotzilla.io/oauth/token
        registrationUrl: https://mcp.kotzilla.io/oauth/register
        revocationUrl: https://mcp.kotzilla.io/oauth/revoke
        scopes:
          openid: OpenID Connect subject identifier for the Kotzilla account
          email: Email address of the authenticated Kotzilla account
          offline_access: Issue a refresh token for long-lived agent sessions
    grant_types_supported: [authorization_code, refresh_token]
    response_types_supported: [code]
    code_challenge_methods_supported: [S256]
    token_endpoint_auth_methods_supported: [none]
    bearer_methods_supported: [header]
    sources:
      - well-known/kotzilla-oauth-authorization-server.json
      - well-known/kotzilla-oauth-protected-resource.json
    observations:
      - >-
        `token_endpoint_auth_methods_supported: ["none"]` plus a public
        registration_endpoint means clients are PUBLIC clients registered
        dynamically (RFC 7591) and authenticated by PKCE alone — the correct
        and expected posture for an MCP server serving arbitrary agent clients.
      - >-
        An unauthenticated POST of tools/list to https://mcp.kotzilla.io/mcp
        returns HTTP 401 with
        {"error":"invalid_token","error_description":"The access token is
        missing or invalid"} — the resource server enforces the token.
      - >-
        `openid` is offered as a scope but no /.well-known/openid-configuration
        is served on mcp.kotzilla.io (404), so this is OAuth 2.0 with an
        OIDC-style scope name rather than a full OIDC provider.

  - name: KotzillaSDKApiKey
    type: apiKey
    in: config-file
    name_hint: kotzilla.json
    surface: Kotzilla SDK -> Kotzilla Platform telemetry ingestion
    description: >-
      The Kotzilla SDK authenticates to the platform with a per-application API
      key delivered in the `kotzilla.json` project file generated from the
      Console (or by the MCP `generate_app_config` tool). The SDK docs state
      transmission uses "HTTPS encryption" with "authentication tokens and API
      Keys". The ingestion hostname is not published in the documentation and
      no api.kotzilla.io host resolves, so the ingest endpoint is NOT recorded
      here rather than guessed.
    sources:
      - https://doc.kotzilla.io/docs/settings/projectFile
      - https://doc.kotzilla.io/docs/discover/sdkData

account:
  signup: https://console.kotzilla.io/signup
  console: https://console.kotzilla.io/
  note: A free Kotzilla account is the credential root for both surfaces.