Overview
Klark MCP uses OAuth 2.0 with PKCE (Proof Key for Code Exchange) to authenticate users. This standard guarantees that your credentials are never shared with the AI client.Authentication flow
1
Discovery
The MCP client discovers the OAuth endpoints through the standard metadata:
2
Dynamic registration
The client automatically registers with the API:It receives a
client_id and client_secret.3
Consent
Your browser opens on the Klark consent page. You enter your credentials and authorize access.
4
Token exchange
The client exchanges the authorization code for an access token (JWT, 60 min) and a refresh token (30 days).
5
MCP connection
The client uses the access token to connect to the MCP server and call the tools.
Available scopes
Scopes control what the AI client can do with your account:Security
PKCE (S256)
PKCE (S256)
Every authorization uses a SHA-256
code_challenge. Even if the authorization code is intercepted, it cannot be used without the original code_verifier.Hashed tokens
Hashed tokens
Refresh tokens and authorization codes are stored as SHA-256 hashes in the database, never in plain text.
Automatic expiration
Automatic expiration
- Access token: 60 minutes
- Refresh token: 30 days
- Authorization code: 10 minutes
Rate limiting
Rate limiting
The OAuth endpoints are protected by rate limiting to prevent abuse.