> ## Documentation Index
> Fetch the complete documentation index at: https://mcp.klark.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How Klark MCP OAuth 2.0 security works

## Overview

Klark MCP uses **OAuth 2.0 with PKCE** (Proof Key for Code Exchange) to authenticate users. This standard guarantees that your credentials are never shared with the AI client.

## Authentication flow

<Steps>
  <Step title="Discovery">
    The MCP client discovers the OAuth endpoints through the standard metadata:

    ```
    GET /.well-known/oauth-authorization-server
    ```
  </Step>

  <Step title="Dynamic registration">
    The client automatically registers with the API:

    ```
    POST /v1/oauth/register
    ```

    It receives a `client_id` and `client_secret`.
  </Step>

  <Step title="Consent">
    Your browser opens on the Klark consent page. You enter your credentials and authorize access.
  </Step>

  <Step title="Token exchange">
    The client exchanges the authorization code for an access token (JWT, 60 min) and a refresh token (30 days).
  </Step>

  <Step title="MCP connection">
    The client uses the access token to connect to the MCP server and call the tools.
  </Step>
</Steps>

## Available scopes

Scopes control what the AI client can do with your account:

| Scope              | Description                         |
| ------------------ | ----------------------------------- |
| `fakture:read`     | Read invoices and quotes            |
| `fakture:write`    | Create, update, delete invoices     |
| `clients:read`     | Read client records                 |
| `clients:write`    | Create and update clients           |
| `products:read`    | Read the product catalog            |
| `products:write`   | Create and update products          |
| `company:read`     | Read company information            |
| `company:write`    | Update company information          |
| `bridge:read`      | View bank accounts and transactions |
| `user:read`        | Read the user profile               |
| `user:write`       | Update the user profile             |
| `prospektor:read`  | Read prospects and stats            |
| `prospektor:write` | Create and update prospects         |
| `dokument:read`    | Read templates and documents        |
| `dokument:write`   | Generate documents                  |

## Security

<AccordionGroup>
  <Accordion title="PKCE (S256)">
    Every authorization uses a SHA-256 `code_challenge`. Even if the authorization code is intercepted, it cannot be used without the original `code_verifier`.
  </Accordion>

  <Accordion title="Hashed tokens">
    Refresh tokens and authorization codes are stored as SHA-256 hashes in the database, never in plain text.
  </Accordion>

  <Accordion title="Automatic expiration">
    * Access token: 60 minutes
    * Refresh token: 30 days
    * Authorization code: 10 minutes
  </Accordion>

  <Accordion title="Rate limiting">
    The OAuth endpoints are protected by rate limiting to prevent abuse.
  </Accordion>
</AccordionGroup>

## Revoking access

To revoke an MCP client's access, you can call:

```bash theme={null}
curl -X POST https://api.klark.app/v1/oauth/revoke \
  -H "Content-Type: application/json" \
  -d '{"token": "your_refresh_token"}'
```