# OAuth and CIMD

This server speaks MCP protocol version `2026-07-28` over Streamable HTTP at
`/mcp`. Clients authenticate with OAuth.

## CIMD only

The authorization server advertises:

```json
{
	"client_id_metadata_document_supported": true
}
```

There is no `registration_endpoint`. Dynamic Client Registration is not
implemented. A client identifies itself with an HTTPS Client ID Metadata
Document URL as `client_id`. This process fetches that document (no redirects),
checks that `client_id` matches the URL, and allowlists `redirect_uri` against
`redirect_uris`.

## PKCE and resource

Authorization requests require PKCE `S256`. Token exchange verifies the
`code_verifier` against the stored challenge.

Clients send the RFC 8707 `resource` parameter. It must equal this server's MCP
URL (`HOME_MCP_PUBLIC_BASE_URL` + `/mcp`). Tokens are audience-bound to that
URL.

Public clients use `token_endpoint_auth_methods_supported: ["none"]`.

## Kody's client values

On hosted Kody, allow these exact values:

| Field          | Value                                                   |
| -------------- | ------------------------------------------------------- |
| `client_id`    | `https://kody.codes/oauth/client-metadata.json`         |
| `redirect_uri` | `https://kody.codes/account/mcp-servers/oauth/callback` |

The metadata document's `client_id` is its own URL and lists that redirect. If
you run a self-hosted Kody, use that deployment's origin in both places instead.

This starter fetches whatever `client_id` URL the authorize request presents, as
long as it is HTTPS (or loopback when the public base URL is `http`). You do not
register clients in a local database.

## Well-known paths

| Path                                        | Document                                    |
| ------------------------------------------- | ------------------------------------------- |
| `/.well-known/oauth-authorization-server`   | Issuer, authorize, token, revoke, CIMD flag |
| `/.well-known/oauth-protected-resource/mcp` | Resource URL and authorization servers      |

Human authorize UI:

- `GET /authorize`
- `POST /authorize`

Machine token endpoints:

- `POST /token`
- `POST /revoke`

Put Access Bypass on the machine paths. See
[Cloudflare Access](./cloudflare-access.md).