O Auth
Public OAuth 2.1 endpoints and discovery metadata for MCP clients (apex host, not the api. subdomain).
POST
/oauth/register
Register an OAuth client (Dynamic Client Registration)
RFC 7591 Dynamic Client Registration for MCP OAuth clients. Public and unauthenticated, but
rate-limited: a redirect URI must be on an allowed first-party origin, and the registered
client is public (no secret, token_endpoint_auth_method: none) and constrained to the
mcp:use scope. It is redeemed with PKCE at the token endpoint.
POST /oauth/register
curl -X POST https://api.minimailer.app/oauth/register \ -H "Authorization: Bearer $MINIMAILER_API_TOKEN" \ -H "Accept: application/vnd.api+json"
Responses
|
Status
|
Description
|
|---|---|
| 201 | Client registered. |
| 400 | Invalid client metadata or a redirect URI on a disallowed origin. |
POST
/oauth/token
Exchange an authorization grant for an access token
OAuth 2.1 token endpoint. Exchanges an authorization code (with PKCE) or a refresh token for
a bearer access token. Public — a dynamically registered client is authenticated by its PKCE
code_verifier, not a secret.
POST /oauth/token
curl -X POST https://api.minimailer.app/oauth/token \ -H "Authorization: Bearer $MINIMAILER_API_TOKEN" \ -H "Accept: application/vnd.api+json"
Responses
|
Status
|
Description
|
|---|---|
| 200 | Access token issued. |
| 400 | Invalid or unsupported grant. |
| 401 | Client authentication failed. |
GET
/.well-known/oauth-protected-resource
OAuth 2.0 Protected Resource Metadata (RFC 9728)
Public discovery document describing this protected resource and its authorization servers.
GET /.well-known/oauth-protected-resource
curl -X GET https://api.minimailer.app/.well-known/oauth-protected-resource \ -H "Authorization: Bearer $MINIMAILER_API_TOKEN" \ -H "Accept: application/vnd.api+json"
Responses
|
Status
|
Description
|
|---|---|
| 200 | Protected resource metadata. |