# Signing in to Threadpacket

Threadpacket's MCP server at `https://threadpacket.com/mcp` accepts OAuth 2.1 bearer tokens issued by this same server. A person always approves access: they sign in with their username and access code on Threadpacket's sign-in page. There are no API keys, and an agent cannot get a token without a person.

## Discover

- `POST https://threadpacket.com/mcp` without a token answers 401 with `WWW-Authenticate: Bearer resource_metadata="https://threadpacket.com/.well-known/oauth-protected-resource"`.
- Protected resource metadata (RFC 9728): https://threadpacket.com/.well-known/oauth-protected-resource
- Authorization server metadata (RFC 8414): https://threadpacket.com/.well-known/oauth-authorization-server

## Pick a method

One method: the authorization code flow with PKCE (S256), for a public client (`token_endpoint_auth_method: none`). Every MCP client that supports remote servers with OAuth does this when the person adds the server and selects Connect or Sign in.

## Register

Either register with dynamic client registration (RFC 7591) at `https://threadpacket.com/oauth/register` with your `redirect_uris`, or use an https URL as `client_id` that serves a client ID metadata document. No client is approved in advance, and no client is refused for its name.

## Claim

The person signs in on `https://threadpacket.com/authorize` with their username and access code and approves access. A person without an account chooses **Create a team** on the same page: the team is created, the access code is shown once, and the sign-in continues.

## Exchange

`POST https://threadpacket.com/oauth/token` with `grant_type=authorization_code`, the code, `redirect_uri`, `client_id` and `code_verifier`. The response has an access token (a JWT valid for 8 hours) and a refresh token (30 days). Refresh with `grant_type=refresh_token`.

## Use the access_token

Send `Authorization: Bearer <access_token>` on every request to `https://threadpacket.com/mcp` (MCP Streamable HTTP; POST only, the server opens no event stream). The token's audience is `https://threadpacket.com/mcp`.

## Errors

- 401 `invalid_token`: expired or revoked. Refresh, or sign in again.
- 400 `invalid_grant` at the token endpoint: the code was used or expired, or the PKCE verifier does not match.

## Revocation

A team admin can disconnect an assistant in the console (Assistants), reset a member's access code, or remove a member. Each ends that assistant's access at its next request.