Skip to main content

​
OAuth 2.1

Nico implements an OAuth 2.1 authorization server for third-party applications and MCP server connections.

​
Overview

OAuth 2.1 allows external applications to access your Nico account with your permission, without sharing your password. This is how AI assistants connect to the MCP server. The authorization server runs at:

​
Client registration

Nico supports Dynamic Client Registration (RFC 7591): MCP clients such as ChatGPT and Claude register themselves automatically when you add the connector — you don’t need to enter a client ID or secret. Leave any OAuth client fields blank and the client will self-register at POST /oauth/register.
Registered clients are public clients — there is no client secret; the flow is secured by PKCE instead (see below). Self-registered clients that request client_secret_basic receive a secret at registration time.

​
Discovery

Nico publishes an OAuth metadata document following RFC 8414:
This returns all endpoints, supported grant types, and available scopes.

​
Authorization flow

Nico uses the authorization code grant type with mandatory PKCE (S256): Access tokens expire after 1 hour; a refresh token is issued alongside so clients can renew access without re-prompting you.

​
Endpoints

The authorization endpoint lives on the app origin because it’s interactive — it shows the login and consent screens using your existing Nico session. The non-interactive endpoints (token, revocation) stay on the MCP host. Clients that use the discovery document get the correct URLs automatically.

​
Scopes

The MCP server requires the mcp scope. Without it, MCP tool calls will be rejected.

​
Managing grants

You can view and revoke OAuth grants in your account:
  • View active grants: See which applications have access to your account
  • Revoke a grant: Remove an application’s access immediately

​
API endpoints for grant management

​
For MCP connections

If you’re connecting an AI assistant via MCP, point it at:
and leave the OAuth client fields blank — the assistant registers itself and handles the OAuth flow for you. You’ll see a consent screen asking you to approve access — click Authorize to connect. The resulting token is stored by the MCP client (e.g., Claude Desktop) and used automatically for future requests. See MCP Server for setup details per assistant.