Authorization & Connection Flow

A client identifies itself with a Client ID Metadata Document (an https URL as its client_id, advertised by client_id_metadata_document_supported) or by OAuth dynamic registration, advertised by registration_endpoint in the server metadata.

Connecting an MCP client uses the OAuth 2.1 authorization code flow with PKCE (S256):

Add Endpoint: Configure your client with the server URL https://www.siglata.com/v1/mcp.
Initiate OAuth: Your client opens a browser window targeting Siglata’s authorization endpoint.
Authenticate: Sign in via your email magic link if not already authenticated.
Select Organization: Choose the specific organization this connection will access. Every grant is strictly bound to a single organization ID.
Approve Scopes: Review the requested capability scopes (e.g., files:read, files:write, organizations:read) and authorize access.
Token Delivery: The client receives an access token scoped exclusively to the chosen organization.

Each approval creates an independent native OAuth connection, even for the same user, client and organization. The connection is bound to the approving user and chosen organization, and stays live while the agent uses it. It expires after 30 days without an MCP call; each call renews that window. Browser logout does not end the connection, and switching the active organization does not rebind it. Token refresh alone does not count as use: expiry requires a new approval. Access tokens expire sooner and are refreshed while the connection is live.

┌────────────────┐        1. OAuth Flow        ┌──────────────────┐
│   MCP Client   │ ──────────────────────────> │  Siglata Auth    │
│ (Codex/Claude) │ <────────────────────────── │  (Siglata Auth)  │
└────────────────┘       2. Scoped Token       └──────────────────┘
        │
        │ 3. JSON-RPC (POST /v1/mcp)
        ▼
┌─────────────────────────────────────────────────────────────────┐
│                     Siglata MCP Server                          │
│  - Origin Verification & Session Validation                     │
│  - Dynamic Membership & Scope Policy Check                      │
│  - Organization Boundary Isolation                              │
└─────────────────────────────────────────────────────────────────┘
        │                                 │
        ▼                                 ▼
┌──────────────────┐              ┌──────────────────┐
│ File Operations  │              │  Org & Members   │
│ (8 MiB chunks)   │              │ (RBAC / Invites) │
└──────────────────┘              └──────────────────┘