Authorization server metadata
RFC 8414 metadata. Served from the host root (no /v1). Public, cacheable for an hour.
Error codes: parameter_invalid, resource_not_found, rate_limited.
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Headers
Optional client correlation id, up to 128 characters. It is not echoed: the response's X-Request-Id is always
our own req_… id. We log your value with the request as client_request_id, so support can find a request by
either id. A longer value is refused with 400 parameter_invalid.
128Response
Metadata.
RFC 8414 metadata. MCP clients find it from the MCP server's protected-resource metadata (https://mcp.panoflow.io/.well-known/oauth-protected-resource, see mcp/README.md).
Issuer identifier.
Consent page in the web app.
Token endpoint.
Only code.
code Supported grants.
authorization_code, refresh_token Only S256; plain is refused.
S256 RFC 7009 revocation.
RFC 7591 dynamic client registration.
Scopes a client may request.
An OAuth scope an agent may be granted. Only these seven exist for agents (CONVENTIONS §10): agent tokens can never hold api_keys:*, team:*, agents:*, payroll:* or any scope that changes limits, allowlists or scopes.
accounts:read, transfers:read, transfers:write, recipients:read, recipients:write, collections:read, collections:write Only query.
query Public clients only (none); PKCE replaces the secret.
none As for the token endpoint.
none Docs.