Authentication: Automo developers

How agents and apps get an Automo access token: OAuth 2.0 with PKCE, dynamic client registration, refresh tokens and workspace connector keys.

Diese Referenz ist auf Englisch veröffentlicht.

Als Markdown lesen

Automo uses OAuth 2.0 authorization code with PKCE (S256 only). The authorization server is https://mo.automo.ai; every endpoint below is public and documented in openapi.json.

Discovery

https://mo.automo.ai/.well-known/oauth-authorization-server (RFC 8414)
https://mo.automo.ai/.well-known/openid-configuration (same metadata, where OpenID clients look; no id_token is issued)
https://mo.automo.ai/.well-known/oauth-protected-resource/mcp (RFC 9728)
An unauthenticated call to /mcp or /v1/tools/{name} answers 401 with a WWW-Authenticate header naming the protected-resource metadata.

Endpoints

Step	Endpoint	Notes
Register	`POST https://mo.automo.ai/oauth/register`	RFC 7591 dynamic registration, no prior credential. Auth methods: none (public clients) or client_secret_post.
Authorize	`GET https://mo.automo.ai/oauth/authorize`	response_type=code, client_id, redirect_uri, code_challenge, code_challenge_method=S256, scope, state.
Token	`POST https://mo.automo.ai/oauth/token`	Form-encoded. grant_type authorization_code (with code_verifier) or refresh_token.
Userinfo	`GET https://mo.automo.ai/oauth/userinfo`	sub, email and email_verified of the connected person.

What the person sees

Signing in uses their normal Automo account (or creating one). The consent screen lists the permissions for the workspace they pick, each as a checkbox, and they can approve a subset. A connection belongs to one workspace; switch_workspace moves it to another workspace the same person belongs to.

Tokens

Access tokens are bearer tokens: send Authorization: Bearer ….
Ask for offline_access to receive a refresh token.
A refresh that answers invalid_grant means the person or an admin disconnected the assistant; start a new authorization.

Connector keys for servers

For a server-to-server integration with no person in the loop, a workspace admin can mint a key in Settings, Developer, Claude Connector, API tokens, choosing its scopes. Keys start with edh_, belong to one workspace, act as the admin who minted them, and work everywhere an access token does.

Machine-readable walkthrough: auth.md.