Security
OAuth
OAuth connectors like Claude.ai connect to MiraDock without copying or exposing your write token.
Why OAuth?
OAuth is the safest path for browser-based connectors. Instead of asking you to paste a write token into another app, MiraDock shows a consent screen and issues scoped OAuth credentials to the connector after you approve it.
Who uses OAuth
Claude on the web and Claude Desktop connectors use OAuth. Clients configured with a header, such as Claude Code, Cursor, and Codex CLI, use write tokens. OAuth access tokens can call every current MCP tool except report_issue, which needs a write token.
The OAuth flow
- Add MiraDock as a custom connector in Claude.ai or Claude Desktop, using https://miradock.com/mcp.
- The connector registers itself with MiraDock and sends you to MiraDock to authorize it.
- MiraDock asks you to sign in if you are not already signed in.
- You review the requested permissions, then choose Allow.
- The connector receives OAuth tokens and appears under Connected apps.
Endpoints
For client developers, MiraDock implements OAuth 2.1 authorization code flow with PKCE and dynamic client registration. MCP requests without a valid token return 401 with a WWW-Authenticate header whose resource_metadata points to the protected resource metadata.
| Item | Details |
|---|---|
| Authorization server metadata | /.well-known/oauth-authorization-server |
| Protected resource metadata | /.well-known/oauth-protected-resource |
| Dynamic client registration | POST /oauth/register; redirect URIs must be HTTPS or http://localhost |
| Authorization | /oauth/authorize; response type code with PKCE S256 required |
| Token | POST /oauth/token; grants authorization_code and refresh_token; client auth client_secret_basic or client_secret_post |
| Lifetimes | Authorization codes 5 minutes, access tokens 1 hour, refresh tokens 30 days |
Scopes
MiraDock exposes 2 OAuth scopes for MCP connectors.
| Scope | What it allows |
|---|---|
| mcp:read | Read the Game SDK spec and validate Games as your account. |
| mcp:write | Create, update, and configure your Games and read their stats. Required for every tool that changes a Game. |
A token without mcp:write that calls a write tool gets HTTP 403 with error="insufficient_scope", or a permission_denied tool error.
Managing connected apps
Open /app/mcp and use the Connected apps section to see authorized OAuth clients, their scopes, when they were first authorized, and when they were last used.
Revoking access
Click Revoke next to a connected app in /app/mcp. MiraDock revokes the app's tokens and consent, so its next request is rejected.