Skip to main content

​
Account and access requirements

Sign in to a brightplace account and authorize your MCP client before using any tool. The server permits initialize and tools/list before sign-in so clients can discover the connector; discovery alone does not grant tool access. A tool call without an authenticated renter identity receives HTTP 401 with a WWW-Authenticate header pointing to OAuth discovery metadata. Complete the sign-in flow, then retry the request. Opening an anonymous connection or removing an expired token does not restore tool access.

​
Discovery and registration

Use this exact production server URL and OAuth resource/audience:
Protected-resource metadata is available at both paths:
Discover the issuer from authorization_servers; do not hard-code an AuthKit hostname. The issuer serves its own authorization-server metadata. The MCP origin also exposes a proxy at /.well-known/oauth-authorization-server. Claude’s authentication documentation says Claude selects CIMD when the issuer advertises both client_id_metadata_document_supported: true and none in token_endpoint_auth_methods_supported; otherwise it can fall back to DCR. Both values are advertised by brightplace’s production and staging issuers as of September 14, 2026. This establishes discovery compatibility, not a guarantee that a particular client has completed login. Leave manually entered client credentials empty for the standard Claude connection flow. DCR-capable clients discover registration_endpoint from the issuer. Registration, consent, token exchange, and refresh are handled by AuthKit and the MCP client; brightplace Connect validates the access token for the configured issuer and audience. The identity is used to attribute tool calls to the renter. Tour requests may use the signed-in account’s name and email; confirm the contact details and intent to send them to the property before submitting a request. These scopes do not imply separate read-only or booking-only permissions: review the tool’s action before approving it. Consent does not authorize signing a lease, submitting an application, or contacting a property outside the explicit tool flow. Use must follow Acceptable Use.

​
Token lifecycle and reconnecting

The protected resource advertises openid, email, and profile. AuthKit also advertises offline_access and the refresh-token grant. Claude may append offline_access to obtain a refresh token. Token issuance and lifetime depend on the authorization server and client configuration; refresh is not guaranteed for every client. When an access token expires, the client should refresh it if supported. If refresh fails or is unavailable, reconnect and sign in again before retrying the tool. The HTTP authentication challenge uses invalid_token / Authentication required; clients must not rely on receiving a distinct TOKEN_EXPIRED tool error. Disconnect in the client’s connector settings to remove that client’s connection. Clients should discard their stored credentials. Disconnecting does not itself prove an already-issued token was revoked at AuthKit; provider-side revocation and token expiry are separate from removing a connector. See Errors & Troubleshooting for recovery steps.

​
Client guidance

  • Send tokens only in the Authorization: Bearer header, never in URLs.
  • Store credentials securely within the consenting account’s client connection.
  • Use the stage-correct MCP URL as the OAuth resource and audience.
  • Do not put tokens into prompts, logs, analytics, or tool outputs.
  • Show the Privacy Policy and Terms of Service during connection.