Skip to main content
brightplace Connect is exposed at this protected resource identifier: 
https://mcp.brightplace.ai/mcp
MCP clients should use that value as the server URL and resource/audience value when OAuth is available.

​
Current access model

OAuth is optional. brightplace Connect accepts unauthenticated tool calls, which are rate-limited and audited by MCP session. When a valid OAuth bearer token is present, brightplace Connect uses it only for account attribution and audit records. A token does not unlock additional tools or change the public tool contracts.

​
Discovery / metadata

brightplace Connect publishes OAuth protected-resource metadata for MCP clients that support RFC 9728: 
https://mcp.brightplace.ai/.well-known/oauth-protected-resource/mcp
The root metadata URL is also supported: 
https://mcp.brightplace.ai/.well-known/oauth-protected-resource
The metadata advertises the brightplace authorization server for the current environment. Clients should discover the authorization server from authorization_servers instead of hard-coding an issuer.
ItemValue
MCP server URLhttps://mcp.brightplace.ai/mcp
OAuth resource/audiencehttps://mcp.brightplace.ai/mcp
Authorization serverDiscover from authorization_servers in protected-resource metadata
Grant typeAuthorization Code with PKCE
Dynamic Client RegistrationNot supported for public clients
The MCP server URL is also the token audience/resource value for RFC 8707 resource indicators.

​
Token lifecycle

Access tokens expire according to the authorization server policy. If a token expires, the client can continue unauthenticated tool calls subject to normal rate limits, or reconnect the account before making OAuth-attributed calls. brightplace Connect does not request offline_access or a refresh-token scope for public clients. If the authorization server issues a refresh token for an approved client, store it only in the client-side account-connection system and use it to obtain a new access token before retrying. Users revoke access by disconnecting brightplace Connect from the AI client or workspace settings. After revocation, clients should discard stored tokens and treat future calls as unauthenticated unless the user reconnects. For token-related failures, handle UNAUTHORIZED and TOKEN_EXPIRED from Error Codes. Consent allows the AI client to call brightplace Connect tools during the conversation. It does not authorize the client to sign a lease, submit an application, contact a property outside the explicit tool flow, or act as a licensed broker. Use must also follow Acceptable Use.

​
Identity scopes

brightplace Connect requests only these identity scopes:
ScopePurpose
openidEstablishes an authenticated identity.
emailAssociates the connection with an email address from the identity provider when available.
profileAssociates basic profile information from the identity provider when available.
brightplace Connect does not request offline_access, refresh-token scopes, or unrelated operator or bulk-data scopes. Tool access is controlled by the server-side MCP tool surface documented here.

​
Client guidance

  • Use https://mcp.brightplace.ai/mcp as the MCP server URL.
  • Treat OAuth as account-linking and account attribution unless brightplace publishes narrower tool scopes later.
  • Show users the brightplace Privacy Policy and Terms of Service before or during account connection.
  • Send access tokens only in the Authorization: Bearer <token> header, never in a URL or query string.
  • Store tokens encrypted at rest and scoped to the MCP session or account connection that received consent.
  • Require the token audience/resource to be restricted to https://mcp.brightplace.ai/mcp.
  • Never cache OAuth tokens in logs, prompts, analytics, or client-visible tool outputs.