Authentication

The API and the MCP server are both OAuth resource servers. A client signs in through the Glasswise login, gets an access token from the authorization server, and sends it as a bearer token.

Authorization server

The Glasswise authorization server is the same service that signs users in to the Glasswise app.

• Issuer: https://auth.glasswise.eu/v1
• Flow: authorization code with PKCE
• Client registration: client id metadata documents (CIMD). The client id is an HTTPS URL that hosts the client’s metadata; the authorization server fetches and validates it.

The MCP server publishes its authorization server in the protected-resource metadata at https://mcp.glasswise.eu/.well-known/oauth-protected-resource, including the path-scoped URL https://mcp.glasswise.eu/.well-known/oauth-protected-resource/mcp.

Required scope

openid graphql:role:api_user

The role scope restricts the token to the api_user role. Both servers reject a token whose role claims are not exactly that one role, including a token minted without a role scope. Do not request the plain graphql scope together with a role scope; the authorization server refuses the combination. Request openid graphql:role:api_user.

Tokens

• Access tokens are JWTs signed with RS256 and expire after 15 minutes.
• The token carries the caller’s user id. The API forwards it upstream unchanged, so the row-level permissions see exactly what that caller may see.
• The token’s audience is the OAuth client’s id, not the API or the MCP server. The role scope and the role claims are the gate.

What a 401 looks like

The API answers an absent token with a bare challenge, and a presented-but-rejected token with error="invalid_token":

WWW-Authenticate: Bearer
WWW-Authenticate: Bearer error="invalid_token"

Both come with an application/problem+json body:

{
  "type": "about:blank",
  "title": "Unauthorized",
  "status": 401,
  "detail": "a valid bearer token is required"
}

The MCP server’s challenge also carries the protected-resource metadata URL and the required scope:

WWW-Authenticate: Bearer resource_metadata="https://mcp.glasswise.eu/.well-known/oauth-protected-resource", scope="openid graphql:role:api_user"