Agent sign-in (OAuth)

An AI client always acts as one human member of an Oriant workspace. Oriant creates no accounts for agents and has no anonymous access. The same facts are published for agents at oriant.app/auth.md.

Registration

Clients register with OAuth 2.0 Dynamic Client Registration (RFC 7591). No secret is needed.

	URL
Registration	`POST https://app.oriant.app/api/auth/oauth2/register`
Authorization server metadata	`https://app.oriant.app/.well-known/oauth-authorization-server`
Protected resource metadata	`https://app.oriant.app/.well-known/oauth-protected-resource/mcp`, and `/mcp/{name}` for each connection

Oriant accepts redirect URIs from local apps on loopback callbacks, Cursor desktop and Claude’s cloud.

Getting a token

Authorization code with PKCE (S256). A member signs in with a passkey or authenticator code and approves the client. Scopes: openid, profile, offline_access.
Refresh token, when offline_access was granted.

Using the token

Send Authorization: Bearer <token> on every MCP request. A token is bound to the resource it was issued for (RFC 8707), so a token for one connection doesn’t work on another. A 401 response carries a WWW-Authenticate header whose resource_metadata points at the metadata to sign in again.

Get started

MCP gateway

Endpoint agent

AI adoption

Guides

Reference

Agent sign-in (OAuth)

Registration

Getting a token

Using the token