Upscrape implements an OAuth 2.1 authorization server for consumer MCP clients. The user signs in to Upscrape and authorizes the client without copying an API key into it.

## Endpoint roles

```text
MCP resource:        https://data.upscrape.com/mcp
Authorization host: https://app.upscrape.com
```

The resource server publishes protected-resource metadata. The authorization server publishes its own metadata and handles authorization, token exchange, refresh, revocation, and client registration.

## Connect

In a client that supports remote MCP OAuth, add this server URL:

```text
https://data.upscrape.com/mcp
```

The client should discover the authorization server, register or identify itself, start an authorization-code flow with PKCE S256, and redirect the browser to Upscrape. After approval, it exchanges the code for an opaque audience-bound access token.

Do not append `/mcp` to `https://app.upscrape.com`; that origin is the authorization server, not the MCP resource endpoint.

## Supported OAuth behavior

- Authorization Code with PKCE S256
- public clients
- dynamic client registration and client-ID metadata documents
- opaque access tokens bound to the MCP resource audience
- rotating refresh tokens
- token revocation
- one current scope: `mcp`

## Consent boundary

The current `mcp` scope gives the connector the account access needed to discover and execute published capabilities at their published credit costs. It is not a read-only scope and it is not limited to one platform.

Review the client and disconnect it when it no longer needs access. Finer-grained scopes are [planned](/docs/mcp/scoped-access).

## Host-scoped browser sessions

Browser sessions are host-scoped. The authorization flow deliberately redirects through the `app.` host where the user's Upscrape session exists. A client should follow discovered metadata and redirect URLs rather than synthesizing them.