MCP ServerReference
Authentication & scopes
How assistants get access through Formclick OAuth 2.1, what each scope allows and how to revoke access.
The MCP server uses Formclick’s own OAuth 2.1 server. Your assistant never sees your password, and you can revoke it at any time.
The sign-in flow
- The assistant calls the server and gets a
401pointing to Formclick’s authorization server. - It registers itself automatically (dynamic client registration or a Client ID Metadata Document).
- You are sent to the Formclick consent screen, where you choose read-only or read + write access.
- The assistant receives a short-lived access token and calls tools on your behalf.
Scopes
| Scope | Access | Allows |
|---|---|---|
forms:read | Read | List your HTML Forms and read their settings, endpoint and embed code. |
submissions:read | Read | Read and search the submissions your forms have received. |
usage:read | Read | See your plan limits and usage. |
forms:write | Write | Create forms and change their name, notification emails and redirect URL. |
webhooks:write | Write | Add and remove webhooks. |
Team members with view-only permission can only grant read access. Every tool call also goes through the same ownership and team-permission checks as the dashboard.
Tokens
- Authorization code flow with PKCE (S256). No implicit or password grants.
- Access tokens last 1 hour and only work for the Formclick MCP server.
- Refresh tokens last 30 days and rotate on every use; reusing an old one revokes the whole chain.
- Codes and tokens are stored only as hashes.
Revoking access
Go to Settings → API & MCP in your Formclick dashboard to see every connected app and revoke any of them. Revoked apps lose access immediately.
Discovery endpoints
| Endpoint | Purpose |
|---|---|
/.well-known/oauth-protected-resource | Tells clients which authorization server protects the MCP endpoint. |
/.well-known/oauth-authorization-server | Authorization server metadata. |
/api/oauth/register | Dynamic client registration. |
/api/oauth/authorize, /api/oauth/token, /api/oauth/revoke | Standard OAuth endpoints. |
All paths are on https://app.formclick.io.
Still need help? Contact support or email support@formclick.io.