# noticed MCP authorization

noticed protects its Model Context Protocol server with OAuth 2.1 or a personal noticed access key. Authorization is required for every tool invocation and every request that can reach a user's relationship data. Public MCP initialization, schema listing, and public documentation resources do not grant access to user data.

## OAuth 2.1 discovery

- Authorization server: https://www.noticed.so
- RFC 8414 metadata: https://www.noticed.so/.well-known/oauth-authorization-server
- OAuth 2.1 dynamic client registration: https://www.noticed.so/api/oauth/register
- Authorization endpoint: https://www.noticed.so/oauth/authorize
- Token endpoint: https://www.noticed.so/api/oauth/token
- Revocation endpoint: https://www.noticed.so/api/oauth/revoke
- MCP protected-resource metadata: https://mcp.noticed.so/.well-known/oauth-protected-resource

Clients use Authorization Code with PKCE S256 and include the MCP resource indicator. Public clients may register with `token_endpoint_auth_method=none`; confidential clients may use `client_secret_basic`. Access and refresh tokens must be sent only in the HTTP `Authorization: Bearer` header, never in a query string.

## Scope

| Scope | Purpose |
| --- | --- |
| `network:read` | Connect to the noticed MCP surface for one authenticated user's tenant. Tool safety annotations and server-side authorization continue to distinguish reads from explicit writes. |

Requests with missing, invalid, revoked, or insufficient bearer credentials are rejected. The MCP challenge includes a `resource_metadata` URL so clients can discover the authorization server without hard-coded configuration.

## Personal noticed access keys

Signed-in noticed users can create and revoke personal noticed access keys at https://www.noticed.so/settings/api-keys. Keys use the `nk_live_` prefix and are shown once. Treat them as passwords. Send a key as `Authorization: Bearer <key>` to https://mcp.noticed.so/api/mcp. Access keys remain tenant-scoped and are rate-limited; revoking a key stops future access.

## MCP JSON-RPC errors

MCP failures use JSON-RPC error objects with a numeric `code` and human-readable `message`. Missing or invalid bearer credentials return HTTP 401 with a `WWW-Authenticate` challenge pointing at the protected-resource metadata. Unknown resources and invalid tool arguments return structured protocol errors rather than an HTML page.

## Security boundary

The MCP server never accepts credentials in URLs. OAuth tokens are audience-bound and verified for issuer, expiry, revocation, and scope. User and Team data remain subject to noticed tenant isolation, membership, consent, and tool-specific authorization rules. Do not forward a noticed credential to another service or expose it in prompts, logs, or tool output.