Skip to content
telemioDeveloper Docs
Open console
DOCUMENTATIONAuthentication · ReferenceBrowse integrations ↗
Docs/Authentication/MCP OAuth and PKCE
AUTHENTICATION · MCP

MCP OAuth and PKCE

How Telemio authorizes AI tools to read production context without asking users to paste tokens.

AI-READY REFERENCE

Pass this guide to your agent

Short, page-specific instructions for an AI coding assistant.

Markdown ↗
Preview agent instructions 
# Telemio agent instructions — MCP OAuth and PKCE

Set up a Telemio remote MCP connection using https://mcp.telemio.sh/mcp. Prefer OAuth authorization code with PKCE S256. Discover metadata from /.well-known/oauth-protected-resource and /.well-known/oauth-authorization-server; do not invent OAuth endpoints or callback URLs. Use client-specific redirects registered with the provider. Request read scope for read operations, write scope only when necessary, and enforce workspace permissions. Never ask the user to paste OAuth tokens, MCP secrets, or server ingest keys. Verify the connection through real MCP tool calls.

Reference: https://telemio.sh/docs/authentication/mcp-oauth.html

Connection flow

An MCP client discovers the protected resource and authorization server, directs the user to Telemio's OAuth sign-in, exchanges an authorization code using PKCE S256, then calls permitted tools. The user's Telemio workspace permissions remain authoritative.

Public discovery endpoints

HTTPS
https://mcp.telemio.sh/mcp
https://mcp.telemio.sh/.well-known/oauth-protected-resource
https://mcp.telemio.sh/.well-known/oauth-authorization-server
https://mcp.telemio.sh/oauth/authorize
https://mcp.telemio.sh/oauth/token

OAuth metadata advertises code_challenge_methods_supported with S256. Clients should follow the published metadata and not infer callback URLs.

Scopes and workspace permissions

The MCP resource defines https://mcp.telemio.sh/mcp/read and https://mcp.telemio.sh/mcp/write. Read access covers authorized investigation; write access may be required for dashboard changes. Scopes do not override workspace role checks.

Redirects and credential safety

Approved MCP connectors may share the Telemio connector OAuth registration, but each connector's actual redirect URI must be allowlisted. This is not unrestricted OAuth registration for arbitrary third-party applications. Do not embed tokens in copied prompts, source code, or public documentation. Handle any client credential only in the client's secure connection setup.

Continue with connecting AI agents, credential separation, and the Developer Connect API.