---
title: "MCP sign-in with OAuth: 1Post docs"
url: "https://get1post.com/docs/mcp-oauth.md"
canonical_url: "https://get1post.com/docs/mcp-oauth"
last_updated: "2026-10-26"
type: "reference"
summary: "How an MCP client registers, signs in with PKCE, gets a token for one workspace and how a person revokes the connection."
related: ["https://get1post.com/docs/mcp.md", "https://get1post.com/docs/api-authentication.md", "https://get1post.com/docs.md"]
---

# MCP sign-in with OAuth: 1Post docs

How an MCP client registers, signs in with PKCE, gets a token for one workspace and how a person revokes the connection.

An MCP client registers itself with POST /oauth/register, sends the person through the sign-in and approval page, and exchanges the code with PKCE at POST /oauth/token. The person chooses the workspace. Tokens refresh, and the person can see and disconnect every connected app in settings.

1. Register the client. Discovery documents are served at the standard well-known addresses.
2. Send the person to the authorization page. They pick a workspace and approve.
3. Exchange the code, with PKCE, for an access token and a refresh token.
4. Call /v1/mcp/oauth with the token. Revocation is supported at POST /oauth/revoke.

The connection acts with the person's role in the workspace they chose. Disconnecting an app in settings ends it at once.

## Questions

**Which standards does it follow?**

Dynamic client registration, protected resource and authorization server metadata, authorization code with PKCE, refresh tokens and token revocation.

## Related

- [The MCP server: 1Post docs](https://get1post.com/docs/mcp.md)
- [API authentication and keys: 1Post docs](https://get1post.com/docs/api-authentication.md)
- [1Post docs: composer, scheduling, API, webhooks, MCP](https://get1post.com/docs.md)