MCP

Connect with OAuth

Connect consumer MCP clients through OAuth 2.1.

Upscrape implements an OAuth 2.1 authorization server for consumer MCP clients. The user signs in to Upscrape and authorizes the client without copying an API key into it.

## Endpoint roles

```text
MCP resource:        https://data.upscrape.com/mcp
Authorization host: https://app.upscrape.com
```

The resource server publishes protected-resource metadata. The authorization server publishes its own metadata and handles authorization, token exchange, refresh, revocation, and client registration.

## Connect

In a client that supports remote MCP OAuth, add this server URL:

```text
https://data.upscrape.com/mcp
```

The client should discover the authorization server, register or identify itself, start an authorization-code flow with PKCE S256, and redirect the browser to Upscrape. After approval, it exchanges the code for an opaque audience-bound access token.

Do not append `/mcp` to `https://app.upscrape.com`; that origin is the authorization server, not the MCP resource endpoint.

## Supported OAuth behavior

- Authorization Code with PKCE S256
- public clients
- dynamic client registration and client-ID metadata documents
- opaque access tokens bound to the MCP resource audience
- rotating refresh tokens
- token revocation
- one current scope: `mcp`

## Consent boundary

The current `mcp` scope gives the connector the account access needed to discover and execute published capabilities at their published credit costs. It is not a read-only scope and it is not limited to one platform.

Review the client and disconnect it when it no longer needs access. Finer-grained scopes are [planned](/docs/mcp/scoped-access).

## Host-scoped browser sessions

Browser sessions are host-scoped. The authorization flow deliberately redirects through the `app.` host where the user's Upscrape session exists. A client should follow discovered metadata and redirect URLs rather than synthesizing them.

Upscrape implements an OAuth 2.1 authorization server for consumer MCP clients. The user signs in to Upscrape and authorizes the client without copying an API key into it.

Endpoint roles

MCP resource:        https://data.upscrape.com/mcp
Authorization host: https://app.upscrape.com

The resource server publishes protected-resource metadata. The authorization server publishes its own metadata and handles authorization, token exchange, refresh, revocation, and client registration.

Connect

In a client that supports remote MCP OAuth, add this server URL:

https://data.upscrape.com/mcp

The client should discover the authorization server, register or identify itself, start an authorization-code flow with PKCE S256, and redirect the browser to Upscrape. After approval, it exchanges the code for an opaque audience-bound access token.

Do not append /mcp to https://app.upscrape.com; that origin is the authorization server, not the MCP resource endpoint.

Supported OAuth behavior

Authorization Code with PKCE S256
public clients
dynamic client registration and client-ID metadata documents
opaque access tokens bound to the MCP resource audience
rotating refresh tokens
token revocation
one current scope: mcp

The current mcp scope gives the connector the account access needed to discover and execute published capabilities at their published credit costs. It is not a read-only scope and it is not limited to one platform.

Review the client and disconnect it when it no longer needs access. Finer-grained scopes are planned.

Host-scoped browser sessions

Browser sessions are host-scoped. The authorization flow deliberately redirects through the app. host where the user's Upscrape session exists. A client should follow discovered metadata and redirect URLs rather than synthesizing them.