Sign-in for MCP clients
The console’s side of OAuth for remote MCP clients: the consent request and the apps you have connected. The public OAuth endpoints are described under MCP. 4 routes, from the API’s own OpenAPI document.
4 routes. Every path starts at https://cloud-api.qaldy.com. Sign-in, tokens, errors and limits are on the overview.
Routes#
| Method | Path | What it does |
|---|---|---|
| GET | /v1/oauth/authorizations/{id} | A pending sign-in request from an MCP client, for the consent screen |
| POST | /v1/oauth/authorizations/{id}/decision | Allow or refuse an MCP client: the answer says where to send the browser next |
| GET | /v1/workspaces/{ws}/oauth/grants | The apps and agents you have signed in to this workspace (never their tokens) |
| DELETE | /v1/workspaces/{ws}/oauth/grants/{grantId} | End one of your grants at once: its tokens stop working |
Reference#
GET /v1/oauth/authorizations/{id}#
A pending sign-in request from an MCP client, for the consent screen.
- Authentication: the console’s session cookie.
- Token: not available. This route is for a signed-in person in the console (
403 console_onlyfor a token). - Who: signed in, console only
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
id | path | string | yes | 1 to 64 characters |
Response 200
| Field | Type | Required | Notes |
|---|---|---|---|
id | string | yes | at least 1 characters |
expiresAt | string (date-time) | yes | |
client | object | yes | |
client.name | string | yes | at least 1 characters |
client.kind | "registered" · "metadata" | yes | |
client.host | string or null | yes | |
client.recognized | string or null | yes | |
client.homepageHost | string or null | yes | |
redirect | object | yes | |
redirect.origin | string | yes | at least 1 characters |
redirect.host | string | yes | |
redirect.scheme | string | yes | at least 1 characters |
redirect.local | boolean | yes | |
resource | object | yes | |
resource.name | string | yes | |
resource.url | string | yes | |
requestedAccess | "read" · "write" | yes | |
user | object | yes | |
user.name | string | yes | |
user.email | string | yes | |
workspaces | object[] | yes | |
workspaces[].id | string | yes | at least 1 characters |
workspaces[].name | string | yes | at least 1 characters |
workspaces[].slug | string | yes | at least 1 characters |
workspaces[].role | "owner" · "admin" · "builder" · "member" · "viewer" | yes |
Errors: 400, 401, 403, 404, 409, 429 (the error format is on the overview).
POST /v1/oauth/authorizations/{id}/decision#
Allow or refuse an MCP client: the answer says where to send the browser next.
- Authentication: the console’s session cookie.
- Token: not available. This route is for a signed-in person in the console (
403 console_onlyfor a token). - Who: signed in; member of the workspace; console only
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
id | path | string | yes | 1 to 64 characters |
Request body (application/json)
An empty object: {}.
Response 200
| Field | Type | Required | Notes |
|---|---|---|---|
outcome | "allowed" · "denied" | yes | |
redirectTo | string | yes | at least 1 characters |
Errors: 400, 401, 403, 404, 409, 429 (the error format is on the overview).
GET /v1/workspaces/{ws}/oauth/grants#
The apps and agents you have signed in to this workspace (never their tokens).
- Authentication: the console’s session cookie.
- Token: not available. This route is for a signed-in person in the console (
403 console_onlyfor a token). - Who: member, own grants; console only
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
ws | path | string | yes | 1 to 128 characters |
Response 200
| Field | Type | Required | Notes |
|---|---|---|---|
id | string | yes | at least 1 characters |
clientName | string | yes | at least 1 characters |
clientKind | "registered" · "metadata" | yes | |
clientHost | string or null | yes | |
recognized | string or null | yes | |
access | "read" · "write" | yes | |
createdAt | string (date-time) | yes | |
lastUsedAt | string (date-time) or null | yes | |
expiresAt | string (date-time) | yes | |
revokedAt | string (date-time) or null | yes |
Errors: 400, 401, 403, 404, 409, 429 (the error format is on the overview).
DELETE /v1/workspaces/{ws}/oauth/grants/{grantId}#
End one of your grants at once: its tokens stop working.
- Authentication: the console’s session cookie.
- Token: not available. This route is for a signed-in person in the console (
403 console_onlyfor a token). - Who: member, own grants; console only
| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
ws | path | string | yes | 1 to 128 characters |
grantId | path | string | yes | 1 to 64 characters |
Response 200
| Field | Type | Required | Notes |
|---|---|---|---|
ok | true | yes |
Errors: 400, 401, 403, 404, 409, 429 (the error format is on the overview).