> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oriant.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent sign-in (OAuth)

> How an AI client registers with Oriant and gets a token: Dynamic Client Registration, authorization code with PKCE, and protected resource metadata.

An AI client always acts as one human member of an Oriant workspace. Oriant creates no accounts for agents and has no anonymous access. The same facts are published for agents at [oriant.app/auth.md](https://oriant.app/auth.md).

## Registration

Clients register with OAuth 2.0 Dynamic Client Registration (RFC 7591). No secret is needed.

| | URL |
| - | - |
| Registration | `POST https://app.oriant.app/api/auth/oauth2/register` |
| Authorization server metadata | `https://app.oriant.app/.well-known/oauth-authorization-server` |
| Protected resource metadata | `https://app.oriant.app/.well-known/oauth-protected-resource/mcp`, and `/mcp/{name}` for each connection |

Oriant accepts redirect URIs from local apps on loopback callbacks, Cursor desktop and Claude's cloud.

## Getting a token

* **Authorization code with PKCE (S256).** A member signs in with a passkey or authenticator code and approves the client. Scopes: `openid`, `profile`, `offline_access`.
* **Refresh token**, when `offline_access` was granted.

## Using the token

Send `Authorization: Bearer <token>` on every MCP request. A token is bound to the resource it was issued for (RFC 8707), so a token for one connection doesn't work on another. A `401` response carries a `WWW-Authenticate` header whose `resource_metadata` points at the metadata to sign in again.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.