> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pomerado.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Support OAuth in your client

> How an MCP client discovers Pomerado's authorization server and gets a token for an MCP.

This page is for people building an MCP client. Pomerado's MCPs follow the MCP authorization specification: a client discovers the authorization server from the MCP's protected resource metadata.

## Discover and sign in

<Steps>
  <Step title="Get the challenge">
    Send an MCP request without credentials, or with an expired token. The MCP answers `401` with a `WWW-Authenticate` header that names `resource_metadata`.
  </Step>

  <Step title="Read the metadata">
    Fetch that URL. It needs no credentials.
  </Step>

  <Step title="Authorize">
    Use the authorization server the metadata names. It supports dynamic client registration and client ID metadata documents. Request the token for the exact `resource` value.
  </Step>

  <Step title="Call the MCP">
    Send the token as `Authorization: Bearer` on every `POST` to the MCP URL.
  </Step>
</Steps>

```http theme={null}
HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://mcp.pomerado.ai/.well-known/oauth-protected-resource/mcp"
```

```json theme={null}
{
  "resource": "https://mcp.pomerado.ai/mcp",
  "authorization_servers": ["https://..."],
  "bearer_methods_supported": ["header"]
}
```

| Field | Meaning |
| - | - |
| `resource` | The MCP URL, used as the token's audience |
| `authorization_servers` | The authorization server to use |
| `bearer_methods_supported` | `header`: send the token in the Authorization header |
| `scopes_supported` | Present only when Pomerado publishes OAuth scopes; often absent |

An integration MCP's metadata is at `/.well-known/oauth-protected-resource/mcp/integrations/{integration_id}` on the same host.

## Rules

* Read the authorization server from the metadata. Don't hard-code it.
* Use the MCP URL exactly, without a trailing slash or query string.
* Each MCP is its own resource. See [permissions](/guides/authentication/permissions#where-a-token-works) for where a token works.
* A `403` whose `WWW-Authenticate` header has `error="insufficient_scope"` means the credential isn't allowed here. Request any `scope` the challenge names.
* The MCP takes `POST` only. A request with an `Origin` header must come from an allowed origin.
* A URL ending in `/keyless` never sends the challenge. A client there signs in with `sign_in` or connects to the signed-in URL.

A client may also skip OAuth and send an API key as the bearer token. See [API keys](/guides/authentication/api-keys).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.