> ## Documentation Index
> Fetch the complete documentation index at: https://platform.take.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How the Take App MCP server authorizes AI assistants using OAuth 2.1.

The MCP server is an OAuth 2.1 protected resource. Compliant MCP clients — including Claude and ChatGPT — discover and complete the flow automatically; you only click **Approve**.

## Discovery

The server advertises its authorization server per [RFC 9728](https://datatracker.ietf.org/doc/html/rfc9728). An unauthenticated request returns `401` with a `WWW-Authenticate` header pointing at:

```
https://take.app/.well-known/oauth-protected-resource
```

That document names the authorization server, whose metadata ([RFC 8414](https://datatracker.ietf.org/doc/html/rfc8414)) lives at:

```
https://take.app/.well-known/oauth-authorization-server
```

## Flow

1. **Dynamic client registration** ([RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591)) — the assistant registers itself and gets a `client_id`. No manual setup.
2. **Authorization code + PKCE** (`S256`) — you sign in to Take App, choose which store to connect, and approve. The connection is scoped to that one store.
3. **Token exchange** — the assistant exchanges the code for an access token and a refresh token.

Access tokens are Bearer tokens sent on every request:

```http theme={null}
POST https://take.app/api/mcp
Authorization: Bearer YOUR_ACCESS_TOKEN
```

## Permissions

Connections use the `all` scope for full access to read and manage products, orders, customers, and inventory, and to send messages. It includes token refresh for up to one year from approval; after that, reconnect the assistant. Granular tool permissions will come later.

## Managing connections

Every connected assistant appears in your admin dashboard under **Settings → Integrations → API keys**, where you can disconnect it at any time. Disconnecting revokes its token immediately.