OAuth flow

SHINE’s MCP server is an OAuth 2.1 authorization server with Dynamic Client Registration (DCR). You don’t configure a client ID or secret — the AI app registers itself.

Discovery endpoints

• GET https://mcp.shineai.io/.well-known/oauth-protected-resource
• GET https://mcp.shineai.io/.well-known/oauth-authorization-server

These expose the issuer, authorization endpoint, token endpoint, registration endpoint, supported scopes, and PKCE requirements.

Supported flow

Authorization Code + PKCE (S256). No implicit flow, no client_secret, no password grant.

Steps

1. DCR — the AI app POSTs to /register with its redirect_uris. The server returns a client_id (format: shine_oauth_<32 hex>).
2. Authorize — the AI app sends the user to /authorize?response_type=code&client_id=...&redirect_uri=...&code_challenge=...&code_challenge_method=S256&scope=...&state=....
3. Consent — the server redirects to https://shineai.io/mcp-oauth/consent where the user signs in to SHINE and approves the requested scopes.
4. Code — the user is redirected back to redirect_uri with ?code=...&state=....
5. Token exchange — the AI app POSTs to /token with grant_type=authorization_code, code, code_verifier, redirect_uri, client_id. The server returns access_token (format: shine_sk_live_..., 1-hour TTL) and refresh_token (30-day TTL).
6. Use — subsequent requests to /v1/mcp carry Authorization: Bearer shine_sk_live_....

Scopes

See Scopes for the full list. Default on authorize: answers:read search:read.

Refresh

POST /token with grant_type=refresh_token, refresh_token, client_id. Returns a new access token. The refresh token stays valid for 30 days from issue.

Revocation

Users revoke access from their SHINE AI settings page under MCP API Keys. Revocation is instant on the next request.