Authentication

Two ways in, and both act as one person with that person's role: OAuth sign-in, and a personal token. Nothing else reaches the MCP server.

OAuth 2.1 (Meta Muse, claude.ai and other apps)

An app that supports MCP authorization finds everything it needs from the server's 401 answer, which points at the protected resource metadata. The person signs in to the portal, sees "Allow <app> to use YugaTek as you?" and chooses Allow or Cancel.

• PKCE with S256 is required. plain and a missing challenge are refused.
• Redirect addresses must be https, or http on localhost or 127.0.0.1 for a desktop app.
• An authorization code works once and lasts 60 seconds. An access token lasts 1 hour; a refresh token lasts 30 days and is replaced each time it is used.
• The person can disconnect the app at any time in Settings → API access, and its tokens stop working at once.

curl -X POST https://portal.yugatek.net/oauth/register \
  -H "content-type: application/json" \
  -d '{"client_name":"My assistant","redirect_uris":["http://127.0.0.1:8123/callback"],"token_endpoint_auth_method":"none"}'

Personal tokens

For tools that take a pasted token (Claude Desktop, Claude Code, Grok, scripts). Open the portal, go to Settings → API access, choose "+ Create token" and give it a name. The token looks like yt_pat_… and is shown once: copy it then. Send it on every call:

Authorization: Bearer yt_pat_••••••••

• The name you give a token appears in the activity log next to every change it makes.
• An owner or admin sees and can revoke everyone's tokens; everyone else sees their own.
• A token stops working when it is revoked or when its person leaves the workspace.