# Sign-in and authentication

The Dyme MCP server requires sign-in. Every request to `https://mcp.dyme.earth/api/mcp` carries an OAuth access token issued to one Dyme account. A request without one gets HTTP 401 with a `WWW-Authenticate` header that points to the metadata below, which is how an assistant knows to start sign-in.

## Discovery

| Document | Address |
|---|---|
| Protected resource metadata (RFC 9728) | `https://mcp.dyme.earth/.well-known/oauth-protected-resource` |
| Authorization server metadata (RFC 8414) | `https://mcp.dyme.earth/.well-known/oauth-authorization-server` |

## The flow

OAuth 2.1, authorization code with PKCE (`S256` only). Public clients: no client secret.

| Step | Endpoint |
|---|---|
| Register (RFC 7591, dynamic client registration) | `POST https://mcp.dyme.earth/register` |
| Authorize | `https://mcp.dyme.earth/authorize` |
| Token (code and refresh) | `POST https://mcp.dyme.earth/token` |
| User info | `https://mcp.dyme.earth/userinfo` |

Scopes: `openid`, `profile`, `email`. The traveller signs in with their Dyme account on dyme.earth.

## Lifetimes

| Item | Lifetime |
|---|---|
| Authorization code | 5 minutes, single use, bound to the client and its PKCE challenge |
| Access token | 1 hour |
| Connection (refresh) | 90 days from sign-in, however often it is refreshed; then the traveller signs in again |

## Approved return addresses

Dynamic registration accepts any client, but the authorization step only redirects to approved callback addresses:

- Claude: `https://claude.ai/api/mcp/auth_callback`, `https://claude.com/api/mcp/auth_callback`
- ChatGPT: `https://chatgpt.com/connector_platform_oauth_redirect` and ChatGPT's per-connector callbacks on chatgpt.com
- Meta Muse: `https://agent.meta.ai/api/hatch/oauth/callback`

Any other address is refused. To connect a new assistant or product, email hello@dyme.earth with its callback address.

## User info

`/userinfo` returns the account's `sub` and `email`. `email_verified` is `false`: signing in to Dyme does not, by itself, prove the inbox.

HTML version: https://dyme.earth/ai/docs/authentication