Developers
Authentication
OAuth 2.1 for agent hosts and scoped API keys for trusted services.
OAuth and API keys use the same scope, role, membership, visibility, and effect checks.
OAuth
Modern hosts should use a Client ID Metadata Document. Dynamic Client
Registration remains available for legacy clients. Authorization requires PKCE
S256 and binds tokens to https://mcp.hivebase.ai.
The protected-resource metadata is:
https://mcp.hivebase.ai/.well-known/oauth-protected-resourceAuthorization-server metadata and browser flows live on app.hivebase.ai.
Refresh tokens rotate, revoked token families fail, redirect URIs match exactly,
and authorization responses include the RFC 9207 issuer.
Consent capabilities
| Capability | Scopes | Default |
|---|---|---|
| Catch me up | context:read, decision:read | On |
| Remember what we decide | context:write, decision:write | Explicit toggle |
Finish bounded work appears only for invited workspaces with a certified action pack.
API keys
Trusted services can send a scoped hb_sk_* key:
Authorization: Bearer hb_sk_...If a request lacks a scope, the WWW-Authenticate challenge identifies the
exact required scope.