# Sign-in for MCP clients

The console’s side of OAuth for remote MCP clients: the consent request and the apps you have connected. The public OAuth endpoints are described under MCP. 4 routes, from the API’s own OpenAPI document.

URL: https://docs.qaldy.com/reference/api/oauth/

4 routes. Every path starts at `https://cloud-api.qaldy.com`. Sign-in, tokens, errors and limits are on the [overview](https://docs.qaldy.com/reference/api/).

## Routes

| Method | Path | What it does |
|---|---|---|
| [[GET]] | [`/​v1/​oauth/​authorizations/​{id}`](#get-v1-oauth-authorizations-id) | A pending sign-in request from an MCP client, for the consent screen |
| [[POST]] | [`/​v1/​oauth/​authorizations/​{id}/​decision`](#post-v1-oauth-authorizations-id-decision) | Allow or refuse an MCP client: the answer says where to send the browser next |
| [[GET]] | [`/​v1/​workspaces/​{ws}/​oauth/​grants`](#get-v1-workspaces-ws-oauth-grants) | The apps and agents you have signed in to this workspace (never their tokens) |
| [[DELETE]] | [`/​v1/​workspaces/​{ws}/​oauth/​grants/​{grantId}`](#delete-v1-workspaces-ws-oauth-grants-grantid) | End one of your grants at once: its tokens stop working |

## Reference

### [[GET]] `/v1/oauth/authorizations/{id}`

A pending sign-in request from an MCP client, for the consent screen.

- **Authentication:** the console’s session cookie.
- **Token:** not available. This route is for a signed-in person in the console (`403 console_only` for a token).
- **Who:** signed in, console only

| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
| `id` | path | string | yes | 1 to 64 characters |

**Response 200**

| Field | Type | Required | Notes |
|---|---|---|---|
| `id` | string | yes | at least 1 characters |
| `expiresAt` | string (date-time) | yes |  |
| `client` | object | yes |  |
| `client.name` | string | yes | at least 1 characters |
| `client.kind` | "registered" · "metadata" | yes |  |
| `client.host` | string or null | yes |  |
| `client.recognized` | string or null | yes |  |
| `client.homepageHost` | string or null | yes |  |
| `redirect` | object | yes |  |
| `redirect.origin` | string | yes | at least 1 characters |
| `redirect.host` | string | yes |  |
| `redirect.scheme` | string | yes | at least 1 characters |
| `redirect.local` | boolean | yes |  |
| `resource` | object | yes |  |
| `resource.name` | string | yes |  |
| `resource.url` | string | yes |  |
| `requestedAccess` | "read" · "write" | yes |  |
| `user` | object | yes |  |
| `user.name` | string | yes |  |
| `user.email` | string | yes |  |
| `workspaces` | object[] | yes |  |
| `workspaces[].id` | string | yes | at least 1 characters |
| `workspaces[].name` | string | yes | at least 1 characters |
| `workspaces[].slug` | string | yes | at least 1 characters |
| `workspaces[].role` | "owner" · "admin" · "builder" · "member" · "viewer" | yes |  |

Errors: `400`, `401`, `403`, `404`, `409`, `429` (the error format is on the [overview](https://docs.qaldy.com/reference/api/#errors)).

### [[POST]] `/v1/oauth/authorizations/{id}/decision`

Allow or refuse an MCP client: the answer says where to send the browser next.

- **Authentication:** the console’s session cookie.
- **Token:** not available. This route is for a signed-in person in the console (`403 console_only` for a token).
- **Who:** signed in; member of the workspace; console only

| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
| `id` | path | string | yes | 1 to 64 characters |

**Request body** (`application/json`)

An empty object: `{}`.

**Response 200**

| Field | Type | Required | Notes |
|---|---|---|---|
| `outcome` | "allowed" · "denied" | yes |  |
| `redirectTo` | string | yes | at least 1 characters |

Errors: `400`, `401`, `403`, `404`, `409`, `429` (the error format is on the [overview](https://docs.qaldy.com/reference/api/#errors)).

### [[GET]] `/v1/workspaces/{ws}/oauth/grants`

The apps and agents you have signed in to this workspace (never their tokens).

- **Authentication:** the console’s session cookie.
- **Token:** not available. This route is for a signed-in person in the console (`403 console_only` for a token).
- **Who:** member, own grants; console only

| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
| `ws` | path | string | yes | 1 to 128 characters |

**Response 200**

| Field | Type | Required | Notes |
|---|---|---|---|
| `id` | string | yes | at least 1 characters |
| `clientName` | string | yes | at least 1 characters |
| `clientKind` | "registered" · "metadata" | yes |  |
| `clientHost` | string or null | yes |  |
| `recognized` | string or null | yes |  |
| `access` | "read" · "write" | yes |  |
| `createdAt` | string (date-time) | yes |  |
| `lastUsedAt` | string (date-time) or null | yes |  |
| `expiresAt` | string (date-time) | yes |  |
| `revokedAt` | string (date-time) or null | yes |  |

Errors: `400`, `401`, `403`, `404`, `409`, `429` (the error format is on the [overview](https://docs.qaldy.com/reference/api/#errors)).

### [[DELETE]] `/v1/workspaces/{ws}/oauth/grants/{grantId}`

End one of your grants at once: its tokens stop working.

- **Authentication:** the console’s session cookie.
- **Token:** not available. This route is for a signed-in person in the console (`403 console_only` for a token).
- **Who:** member, own grants; console only

| Parameter | In | Type | Required | Notes |
|---|---|---|---|---|
| `ws` | path | string | yes | 1 to 128 characters |
| `grantId` | path | string | yes | 1 to 64 characters |

**Response 200**

| Field | Type | Required | Notes |
|---|---|---|---|
| `ok` | true | yes |  |

Errors: `400`, `401`, `403`, `404`, `409`, `429` (the error format is on the [overview](https://docs.qaldy.com/reference/api/#errors)).