OAuth and MCP
Connect to Dativue with the official MCP client, OAuth discovery, and a stable product identity.
Connection details#
| Setting | Value |
|---|---|
| Transport | MCP over Streamable HTTP |
| MCP endpoint and OAuth resource | https://dativue.com/mcp |
| Protected resource metadata | https://dativue.com/.well-known/oauth-protected-resource/mcp |
| Authorization server metadata | https://dativue.com/.well-known/oauth-authorization-server |
| OAuth scope | research:read |
| Grant types | authorization_code, refresh_token |
| PKCE | S256 |
| Sign-in and billing | Customer's own Dativue account |
Use the official client#
Use the official MCP client SDK for your language and follow its OAuth discovery, registration, and transport APIs.
The tested Node reference pins @modelcontextprotocol/client to 2.3.1; SDK v1 uses different import paths, so do not mix examples across major versions.
See the official TypeScript OAuth guide.
Dativue supports dynamic client registration and Client ID Metadata Documents, so developers do not need a manually approved Dativue app or a client secret supplied by Dativue. Persist any registration information returned by the SDK securely, unchanged, including its issuer binding.
Keep a stable product identity#
Use one stable client identity per product and deployment, shared across its customers. For dynamic registration, persist and serialize registration at application scope rather than registering a new client for each customer, request, or process restart.
When hosting a public Client ID Metadata Document, use one stable HTTPS document URL and accurate callback metadata for that deployment. Use separate client identities for local, staging, and production deployments. Use one fixed, exactly registered callback URL per product deployment; use HTTPS in production and a loopback callback for local development.
Validate issuer and resource#
Do not send Dativue's website session cookies to its MCP server or use /api/account/* as a public OAuth API.
Discover endpoint locations and token lifetimes from the server rather than hardcoding them from this guide.
Pin the expected issuer and MCP resource, preserve issuer validation, and reject discovery or redirects to unexpected origins.