Authentication
The server is an OAuth 2.0 protected resource. MCP clients need no pre-registered credentials — everything a client needs is published at the server's discovery endpoints, which is why "paste the URL" is the entire setup.
The flow
- Discovery. The client fetches the protected-resource metadata
(
/.well-known/oauth-protected-resource), which points at the authorisation server and its capabilities. - Authorisation. The client opens the authorisation URL in your browser. You sign in with the same Google or Apple identity you use on core.app.
- Token exchange. The client exchanges the authorisation code for an access token, sent as a bearer token on every subsequent MCP request.
- Refresh. Expired tokens are refreshed by the client without another sign-in, until you revoke access.
Identity binds the wallet
The OAuth identity is the wallet identity: signing in as
[email protected] connects the agent to the Core wallet owned by that
account. There are no shared API keys, and a leaked token is bound to its
user and constrained by the policy like every other
caller.
Revoking access
Two independent kill switches:
- Disable the policy in Core Web (Settings → AI connectors) — every tool call fails immediately, even with a valid token.
- Remove the connector in the assistant, which drops its tokens.
Transport
MCP requests ride Streamable HTTP. The server is stateless — each request is authenticated and policy-checked on its own, with no session affinity.