MCP: Start registered-client authorization

Validate exact registered redirect URI and explicit allowlisted scopes before any redirect. Require response_type=code, high-entropy state (16–512 bytes), S256 and a 43-character base64url challenge. Unauthenticated users continue through existing login/onboarding using a five-minute opaque request bound to the eventual browser session. GET always requires explicit consent; no automatic approval. Return errors locally for unknown/untrusted callbacks. Clients must verify state and response iss. A resumed request uses only request, with no other query parameters.

Response headers:

Cache-Control (200).
Referrer-Policy (200): Native consent form Origin proof; never sends referrers cross-origin.
Pragma (200).

MCP accepts the configured resource URI for identity.read, offline_access, translation.list, translation.get, translation.read, translation.search, live.list and live.get. Registered client scopes, current actor permissions and explicit fresh consent bound each grant; existing grants cannot gain scopes through refresh. Exact fixed-port localhost HTTP callbacks are supported alongside literal loopback addresses. Uses the dedicated MCP issuer https://bibleit.app/oauth/mcp. Existing REST OAuth endpoints and error contracts remain unchanged.

Query parameters

response_type"code"Optional

client_idstringOptional

redirect_uristringOptionalformat: "uri"

scopestringOptional1-512 characters

Space-separated explicit registered personal scopes. No empty scope. offline_access alone is invalid.

statestringOptional16-512 characters

code_challengestringOptionalformat: "^[a-zA-Z0-9_-]{43}$"

code_challenge_method"S256"Optional

requeststringOptionalformat: "^[a-f0-9]{64}$"

resourcestringOptionalformat: "uri"<=2048 characters

Optional MCP resource indicator. Must equal the configured MCP resource URI and remain identical at code and refresh exchange. Omit for existing REST-only grants. MCP permits identity.read, offline_access and the read-only scopes advertised by its issuer metadata. Newly requested scopes require client approval and fresh user consent; existing grants are never widened automatically.

prompt"consent"Optional

Optional explicit consent request, used by Claude Code. Silent authorization is not supported.

ui_localesstringOptional<=256 characters

Optional bounded space-separated language tags, as sent by ChatGPT. Advisory only; consent currently retains its existing language.

Response headers

Cache-Control"no-store"Optional

Referrer-Policy"same-origin"Optional

Native consent form Origin proof; never sends referrers cross-origin.

Pragma"no-cache"Optional

Response

Escaped server-rendered consent/connected-app page. No token is issued by GET.