OAuth 2.1

Sign in from ChatGPT or Claude.

DropAgent speaks OAuth 2.1 for the MCP server and the REST API. The grant is authorization code with PKCE (S256 only). Clients can register themselves. Workspace bearer keys (da_live_ and dak_test_) keep working and are not scoped. OAuth tokens are scoped, and you can revoke them in Settings.

Discovery
Protected resource	`https://getdropagent.com/.well-known/oauth-protected-resource`
MCP resource	`https://getdropagent.com/.well-known/oauth-protected-resource/api/mcp`
Authorization server	`https://getdropagent.com/.well-known/oauth-authorization-server`
Register	`POST https://getdropagent.com/oauth/register`
Authorize	`https://getdropagent.com/oauth/authorize`
Token	`POST https://getdropagent.com/oauth/token`
Revoke	`POST https://getdropagent.com/oauth/revoke`

A 401 response includes WWW-Authenticate with resource_metadata so ChatGPT apps and Claude custom connectors can find the authorization server. The consent screen asks for a workspace key and shows the scopes before anything is issued. Approving with a dak_test_ key keeps that connection in test mode.

Public client registration

curl -X POST https://getdropagent.com/oauth/register \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "My agent",
    "redirect_uris": ["https://example.com/callback"],
    "grant_types": ["authorization_code", "refresh_token"],
    "response_types": ["code"],
    "token_endpoint_auth_method": "none",
    "scope": "drops:read drops:write offline_access"
  }'

Scopes: drops:read, drops:write, contacts:write, sms:write, campaigns:write, billing:read, numbers:write, offline_access. Access tokens last one hour. Refresh tokens last 30 days and rotate on use. Plain PKCE is rejected.