OAuth 2.1
Truestamp's built-in authorization server (authorize, token, register, revoke endpoints with RFC 8414/9728 discovery) issuing audience-bound access tokens and rotating refresh tokens via PKCE S256 consent, with per-surface mcp/api/console read and write scopes; the only credential MCP accepts.
Overview
OAuth 2.1 is the delegated-authorization mechanism Truestamp runs itself: a
standards-compliant authorization server that lets a client such as
the truestamp CLI or an LLM agent connector act as you
without holding your password or a pasted API key. A client self-registers
via dynamic client registration, sends you to a browser consent screen, and runs
the authorization-code flow with PKCE (S256 only, no client secrets). It
receives a 24-hour access token bound to the Truestamp origin plus a rotating
30-day refresh token, and the token carries per-surface scopes (mcp:read,
mcp:write, api:read, api:write, console:read, console:write) that say
exactly what it may do. An OAuth access token authenticates all four API
surfaces; the MCP server accepts OAuth tokens
exclusively, while JSON:API, GraphQL, and the console WebSocket accept either an
OAuth token or an API key. The endpoints, discovery documents, token lifetimes,
and security properties are covered in
the OAuth 2.1 authorization server.