Agent Platform

Agent OAuth and scopes

Implement authorization code with PKCE S256, workspace consent, token exchange and revocation.

GET/.well-known/oauth-authorization-server

Live authorization, token, revocation, PKCE and supported-scope metadata.

GET/.well-known/oauth-protected-resource

Resource metadata for OAuth-aware MCP and API clients.

GET/oauth/authorize

Validate the request and redirect the user to the Fullness consent screen.

POST/oauth/token

Exchange a single-use authorization code and PKCE verifier for an access token.

POST/oauth/revoke

Immediately revoke an access token.

Authorization request requirements

Parameter	Requirement
`client_id`	Active registered client
`redirect_uri`	Exact registered HTTPS URI
`response_type`	`code`
`code_challenge_method`	`S256`
`code_challenge`	Derived from the server-held verifier
`scope`	Non-empty, registered and currently released
`purpose`	Human-readable, 3–240 characters
`state`	Unpredictable, 16–512 characters

Token behavior

Authorization codes expire after five minutes and are single-use.
Access tokens are opaque and expire after one hour.
Revoking the token, grant or client takes effect immediately.
Confidential clients may use client_secret_post; public clients use no token-endpoint authentication and still require PKCE.

Scope composition

A usable grant combines an action scope, data authority and required privacy scopes. Exact tool:<name> scopes are supported, but never bypass privacy requirements or the prohibited-tool boundary.

Example scope set

actions:read
tool:get_account_balances
privacy:shareAccounts