# Onticord agent signup and authentication Public onboarding MCP: https://auth.staging.onticord.ai/mcp Workspace MCP (OAuth required): https://api.staging.onticord.ai/api/mcp Guide: https://auth.staging.onticord.ai/agents 1. Call get_auth_guide on the public MCP endpoint. No account or bearer token is required. 2. With the account owner's authorization, call create_account using a dedicated email and password. Store credentials securely; do not reuse a person's password. One workspace is created automatically. 3. Connect your MCP client to workspace_mcp_url and follow its OAuth flow. Discover the issuer, register a public client (token_endpoint_auth_method: none), and use authorization_code with S256 PKCE, a random state, and oauth_resource. Request openid and app.access for workspace tools; include offline_access if refresh is needed. 4. Open the returned authorization URL. Sign in (or create an account there), select an organization if asked, and explicitly choose Allow or Deny. Browser WebMCP tools cover each step and return next_url to navigate to after the tool result is received. 5. Exchange the callback code with the original code_verifier and redirect_uri. Send the OAuth access_token as Authorization: Bearer to the workspace MCP endpoint. Store tokens in your client's credential store. ## Connection details and requirements { "public_mcp_url": "https://auth.staging.onticord.ai/mcp", "workspace_mcp_url": "https://api.staging.onticord.ai/api/mcp", "documentation_url": "https://auth.staging.onticord.ai/agents", "text_documentation_url": "https://auth.staging.onticord.ai/llms.txt", "onboarding_url": "https://auth.staging.onticord.ai/onboarding", "signup_url": "https://auth.staging.onticord.ai/sign-up", "signin_url": "https://auth.staging.onticord.ai/sign-in", "panel_url": "https://panel.staging.onticord.ai", "signup_api_url": "https://auth.staging.onticord.ai/api/auth/sign-up/email", "signin_api_url": "https://auth.staging.onticord.ai/api/auth/sign-in/email", "authorization_server_metadata_url": "https://auth.staging.onticord.ai/.well-known/oauth-authorization-server/api/auth", "protected_resource_metadata_url": "https://api.staging.onticord.ai/.well-known/oauth-protected-resource", "oauth_resource": "https://api.staging.onticord.ai", "protocol_version": "2026-07-28", "delegated_scope_policy": "app.access permits business reads and onboarding proof. Explicitly request workflows.run, workflows.simulate, skills.draft, connections.manage, packs.manage, members.read, members.request, triggers.read, triggers.manage, effects.request, or gates.redeliver for those operations. Current member authority is always checked. Approval, installation, and access changes still require a human decision.", "transport": "Streamable HTTP; stateless, request-scoped SSE; legacy 2025 clients supported", "signup": { "required": [ "email", "password" ], "optional": [ "name", "organizationType", "organizationName" ], "password_min_length": 8, "password_max_length": 128, "default_organization_type": "personal", "team_requirement": "Set organizationType to team and supply organizationName (1–100 characters)." }, "direct_http": { "content_type": "application/json", "signup_body": { "email": "your-agent@example.com", "password": "", "name": "Your agent", "organizationType": "personal" }, "signup_required": [ "email", "password", "name" ], "signin_body": { "email": "your-agent@example.com", "password": "" }, "session_handling": "Retain Set-Cookie in a private cookie jar. Public MCP intentionally does not return these credentials; use direct HTTP signup/signin if your client needs a session without a browser.", "register_url": "https://auth.staging.onticord.ai/api/auth/oauth2/register", "register_body": { "client_name": "Your agent", "redirect_uris": [ "http://127.0.0.1:9999/callback" ], "grant_types": [ "authorization_code", "refresh_token" ], "response_types": [ "code" ], "token_endpoint_auth_method": "none", "application_type": "native" }, "authorize_url": "https://auth.staging.onticord.ai/api/auth/oauth2/authorize", "authorize_query": "client_id, response_type=code, redirect_uri, scope=openid offline_access app.access, random state, code_challenge=BASE64URL(SHA256(code_verifier)), code_challenge_method=S256, resource=oauth_resource", "organizations_url": "https://auth.staging.onticord.ai/api/auth/organization/list", "select_organization_url": "https://auth.staging.onticord.ai/api/auth/organization/set-active", "select_organization_body": { "organizationId": "" }, "continue_url": "https://auth.staging.onticord.ai/api/auth/oauth2/continue", "continue_body": "{postLogin: true, oauth_query: }; use selected: true instead of postLogin for prompt=select_account", "consent_url": "https://auth.staging.onticord.ai/api/auth/oauth2/consent", "consent_body": "{accept: , oauth_query: }", "token_url": "https://auth.staging.onticord.ai/api/auth/oauth2/token", "token_form": "application/x-www-form-urlencoded: grant_type=authorization_code, client_id, code, redirect_uri, code_verifier, resource=oauth_resource", "callback_handling": "Do not blindly follow redirects. Validate callback origin/path against your registered redirect_uri and state against your original random state before exchanging its code. Keep callback codes and tokens private." }, "steps": [ "Call get_auth_guide on the public MCP endpoint. No account or bearer token is required.", "With the account owner's authorization, call create_account using a dedicated email and password. Store credentials securely; do not reuse a person's password. One workspace is created automatically.", "Connect your MCP client to workspace_mcp_url and follow its OAuth flow. Discover the issuer, register a public client (token_endpoint_auth_method: none), and use authorization_code with S256 PKCE, a random state, and oauth_resource. Request openid and app.access for workspace tools; include offline_access if refresh is needed.", "Open the returned authorization URL. Sign in (or create an account there), select an organization if asked, and explicitly choose Allow or Deny. Browser WebMCP tools cover each step and return next_url to navigate to after the tool result is received.", "Exchange the callback code with the original code_verifier and redirect_uri. Send the OAuth access_token as Authorization: Bearer to the workspace MCP endpoint. Store tokens in your client's credential store." ], "notes": [ "Public MCP signup creates an account; it returns no password, session cookie, or access token. It does not authorize workspace access. Existing accounts should sign in instead of retrying signup.", "For an HTTP-only client, use the JSON signup/signin endpoints with a cookie jar, then the same OAuth authorization, organization selection and consent endpoints. Preserve the exact signed oauth_query from each provider redirect. Never manufacture consent or skip it.", "Signup/signin API responses contain session credentials: keep them private. Session tokens are not workspace OAuth access tokens.", "On RATE_LIMITED honor retry_after_seconds. On a network error after signup, try sign-in to check whether creation completed before retrying.", "WebMCP is an evolving browser API. We detect document.modelContext and support the earlier navigator.modelContext API; ordinary forms and public MCP remain available in other browsers." ] } ## First request (MCP 2026-07-28) POST https://auth.staging.onticord.ai/mcp Content-Type: application/json Accept: application/json, text/event-stream MCP-Protocol-Version: 2026-07-28 Mcp-Method: tools/call Mcp-Name: get_auth_guide { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "get_auth_guide", "arguments": {}, "_meta": { "io.modelcontextprotocol/protocolVersion": "2026-07-28", "io.modelcontextprotocol/clientInfo": { "name": "your-agent", "version": "1.0.0" }, "io.modelcontextprotocol/clientCapabilities": {} } } } Use server/discover or tools/list with the same request metadata to discover the server or schemas. No initialize handshake or MCP session ID is needed for 2026-07-28. Older clients may initialize with 2025-11-25 and then call tools normally. GET /mcp returns 405; streaming happens on POST responses.