# Authentication & scopes

> How assistants get access through Formclick OAuth 2.1, what each scope allows and how to revoke access.

Source: https://docs.formclick.io/mcp/mcp-authentication

The MCP server uses Formclick’s own OAuth 2.1 server. Your assistant never sees your password, and you can revoke it at any time.

## The sign-in flow

1. The assistant calls the server and gets a `401` pointing to Formclick’s authorization server.
2. It registers itself automatically (dynamic client registration or a Client ID Metadata Document).
3. You are sent to the Formclick **consent screen**, where you choose **read-only** or **read + write** access.
4. The assistant receives a short-lived access token and calls tools on your behalf.

## Scopes

| Scope | Access | Allows |
| --- | --- | --- |
| `forms:read` | Read | List your HTML Forms and read their settings, endpoint and embed code. |
| `submissions:read` | Read | Read and search the submissions your forms have received. |
| `usage:read` | Read | See your plan limits and usage. |
| `forms:write` | Write | Create forms and change their name, notification emails and redirect URL. |
| `webhooks:write` | Write | Add and remove webhooks. |

Team members with view-only permission can only grant read access. Every tool call also goes through the same ownership and team-permission checks as the dashboard.

## Tokens

- Authorization code flow with PKCE (S256). No implicit or password grants.
- Access tokens last **1 hour** and only work for the Formclick MCP server.
- Refresh tokens last **30 days** and rotate on every use; reusing an old one revokes the whole chain.
- Codes and tokens are stored only as hashes.

## Revoking access

Go to **Settings → API & MCP** in your Formclick dashboard to see every connected app and revoke any of them. Revoked apps lose access immediately.

## Discovery endpoints

| Endpoint | Purpose |
| --- | --- |
| `/.well-known/oauth-protected-resource` | Tells clients which authorization server protects the MCP endpoint. |
| `/.well-known/oauth-authorization-server` | Authorization server metadata. |
| `/api/oauth/register` | Dynamic client registration. |
| `/api/oauth/authorize`, `/api/oauth/token`, `/api/oauth/revoke` | Standard OAuth endpoints. |

All paths are on `https://app.formclick.io`.