---
title: "OAuth flow"
description: "SHINE AI implements OAuth 2.1 with Dynamic Client Registration and PKCE. This page explains what happens when a client connects."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.shineai.io/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth flow

SHINE's MCP server is an **OAuth 2.1 authorization server** with Dynamic Client Registration (DCR). You don't configure a client ID or secret — the AI app registers itself.

## Discovery endpoints

- `GET https://mcp.shineai.io/.well-known/oauth-protected-resource`
- `GET https://mcp.shineai.io/.well-known/oauth-authorization-server`

These expose the issuer, authorization endpoint, token endpoint, registration endpoint, supported scopes, and PKCE requirements.

## Supported flow

Authorization Code + PKCE (S256). No implicit flow, no client_secret, no password grant.

## Steps

1. **DCR** — the AI app POSTs to `/register` with its `redirect_uris`. The server returns a `client_id` (format: `shine_oauth_<32 hex>`).
2. **Authorize** — the AI app sends the user to `/authorize?response_type=code&client_id=...&redirect_uri=...&code_challenge=...&code_challenge_method=S256&scope=...&state=...`.
3. **Consent** — the server redirects to `https://shineai.io/mcp-oauth/consent` where the user signs in to SHINE and approves the requested scopes.
4. **Code** — the user is redirected back to `redirect_uri` with `?code=...&state=...`.
5. **Token exchange** — the AI app POSTs to `/token` with `grant_type=authorization_code`, `code`, `code_verifier`, `redirect_uri`, `client_id`. The server returns `access_token` (format: `shine_sk_live_...`, 1-hour TTL) and `refresh_token` (30-day TTL).
6. **Use** — subsequent requests to `/v1/mcp` carry `Authorization: Bearer shine_sk_live_...`.

## Scopes

See [Scopes](/mcp/scopes) for the full list. Default on authorize: `answers:read search:read`.

## Refresh

POST `/token` with `grant_type=refresh_token`, `refresh_token`, `client_id`. Returns a new access token. The refresh token stays valid for 30 days from issue.

## Revocation

Users revoke access from their SHINE AI settings page under **MCP API Keys**. Revocation is instant on the next request.

Source: https://docs.shineai.io/mcp/oauth/index.mdx