OAuth 2.1

Users sign in with their existing Dhahaby account (phone, email or Google) on Dhahaby's own page and approve read-only access. Agents never see passwords or codes.

Endpoints

Purpose	URL
Metadata (RFC 8414)	`https://auth.dhahaby.com/.well-known/oauth-authorization-server`
Authorization	`https://auth.dhahaby.com/oauth/authorize`
Token	`https://auth.dhahaby.com/oauth/token`
Dynamic client registration (RFC 7591)	`https://auth.dhahaby.com/oauth/register`
Device authorization (RFC 8628)	`https://auth.dhahaby.com/oauth/device_authorization`
Revocation (RFC 7009)	`https://auth.dhahaby.com/oauth/revoke`
Signing keys	`https://auth.dhahaby.com/oauth/jwks`

Flows

Authorization code with PKCE

Public clients only (token_endpoint_auth_method: none), S256 only. Redirect URIs must be HTTPS, http://localhost / 127.0.0.1 / [::1] (any port), or a native app's custom scheme. The redirect includes iss (RFC 9207). Send resource=https://mcp.dhahaby.com/mcp (RFC 8707).

GET https://auth.dhahaby.com/oauth/authorize?response_type=code&client_id=…&redirect_uri=…
    &code_challenge=…&code_challenge_method=S256&scope=read%20offline_access
    &state=…&resource=https://mcp.dhahaby.com/mcp

Device authorization

For terminals and devices without a browser. The Aurelia CLI uses it as client aurelia-cli. Poll the token endpoint at the returned interval, and honour slow_down.

Refresh tokens

Issued with offline_access. Each refresh token can be used once and is replaced on every use. Presenting a used one revokes the whole grant, and so does replaying an authorization code.

Scopes

Scope	Grants
`read`	All tools on `/mcp` (read-only)
`offline_access`	A refresh token (30 days, rotating)

No write scope is offered. Applying, signing, paying and booking happen only in the Dhahaby app.

Tokens

Access tokens are EdDSA-signed JWTs (typ: at+jwt) that last 15 minutes, with aud set to https://mcp.dhahaby.com/mcp. Treat them as opaque. Users can disconnect at any time, and revoking the refresh token ends access immediately.