OAuth 2.0 (interactive sign-in for agents)

The Skavio Processing MCP supports two ways to authenticate the same endpoint https://www.skavio.eu/processing/mcp:

• a static MCP credential sent as a Bearer token (see

authentication); and

• OAuth 2.0 Authorization Code with PKCE (S256), which lets a hosted remote

MCP client such as Smithery sign a Skavio customer in and obtain a scoped, short-lived token without ever handling a long-lived secret.

Both paths resolve to the same company-scoped principal, the same permission checks, the same shared prepaid USDC wallet, the same metering, idempotency, margin gate and audit events. No OAuth client can reach data or credits of a company the signed-in user does not belong to.

Discovery (RFC 9728 / RFC 8414)

An unauthenticated request to the MCP endpoint returns an RFC 6750 challenge pointing at the protected-resource metadata:

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://www.skavio.eu/.well-known/oauth-protected-resource/processing/mcp"

The metadata documents are public:

• Protected resource metadata:

https://www.skavio.eu/.well-known/oauth-protected-resource/processing/mcp

• Authorization server metadata:

https://www.skavio.eu/.well-known/oauth-authorization-server/processing/mcp

{
  "resource": "https://www.skavio.eu/processing/mcp",
  "authorization_servers": ["https://www.skavio.eu"],
  "bearer_methods_supported": ["header"],
  "scopes_supported": ["mcp:read", "mcp:process"]
}

{
  "issuer": "https://www.skavio.eu",
  "authorization_endpoint": "https://www.skavio.eu/processing/oauth/authorize",
  "token_endpoint": "https://www.skavio.eu/processing/oauth/token",
  "registration_endpoint": "https://www.skavio.eu/processing/oauth/register",
  "revocation_endpoint": "https://www.skavio.eu/processing/oauth/revoke",
  "response_types_supported": ["code"],
  "grant_types_supported": ["authorization_code", "refresh_token"],
  "code_challenge_methods_supported": ["S256"],
  "token_endpoint_auth_methods_supported": ["none"],
  "resource_indicators_supported": true
}

Public clients register dynamically (RFC 7591) with POST /processing/oauth/register and receive a client_id. No client secret is issued: PKCE is mandatory.

Scopes

mcp:read alone cannot start billable work. Only mcp:process spends credits, and always against the selected company's shared wallet.

The sign-in flow

1. The client opens the authorization_endpoint with response_type=code,

client_id, a registered redirect_uri, scope, state, a resource (https://www.skavio.eu/processing/mcp), and a PKCE code_challenge (S256).

1. The customer signs in with their existing Skavio account (email and

password) on the Skavio-hosted page, then explicitly consents to the client and chooses one of their own companies to authorize.

1. Skavio redirects back to the registered redirect_uri with a one-time,

short-lived code (and the original state).

1. The client exchanges the code at the token_endpoint, proving the PKCE

code_verifier, and receives a token bound to the chosen company and scope.

1. The client calls the MCP endpoint with Authorization: Bearer <token>.

Authorization codes are single-use and expiring. A replayed code revokes its whole token family. Tokens are audience-bound to the exact MCP resource, expire automatically, and can be revoked (RFC 7009) at the revocation_endpoint. Refresh tokens rotate on every use; reusing an old one revokes the family.

Smithery

Smithery's own Connect button performs this flow automatically, so a static credential is not required.

1. In Smithery, open your server (namespace work-6dqn, server

skavio-processing) and click Connect.

1. Smithery reads the protected-resource and authorization-server metadata and

registers itself as a public client.

1. Authenticate with your own Skavio company account and approve the requested

scopes for one company.

1. Smithery stores the resulting token and can then scan and call the tools.

Do not paste a shared master MCP/API token into a hosted third-party form. Interactive OAuth is the supported path for hosted clients. A Bearer Authorization header is only for clients you configure yourself.

Revoking a connected client

Tokens are issued per consent. Revoke a token immediately with:

curl -s https://www.skavio.eu/processing/oauth/revoke \
  -d token=<access_or_refresh_token>

Revocation is immediate and scoped: it never affects another client, another company or the legacy Bearer credentials.

Errors

Is my existing Bearer credential affected?

No. Static MCP credentials keep working unchanged. OAuth is additive: existing clients, tools, wallets, margins and isolation are untouched.