# Authentication: Automo developers

> How agents and apps get an Automo access token: OAuth 2.0 with PKCE, dynamic client registration, refresh tokens and workspace connector keys.

Automo uses OAuth 2.0 authorization code with PKCE (S256 only). The authorization server is https://mo.automo.ai; every endpoint below is public and documented in [openapi.json](https://automo.ai/openapi.json).

## Discovery

- [https://mo.automo.ai/.well-known/oauth-authorization-server](https://mo.automo.ai/.well-known/oauth-authorization-server) (RFC 8414)
- [https://mo.automo.ai/.well-known/openid-configuration](https://mo.automo.ai/.well-known/openid-configuration) (same metadata, where OpenID clients look; no id_token is issued)
- [https://mo.automo.ai/.well-known/oauth-protected-resource/mcp](https://mo.automo.ai/.well-known/oauth-protected-resource/mcp) (RFC 9728)
- An unauthenticated call to /mcp or /v1/tools/{name} answers 401 with a `WWW-Authenticate` header naming the protected-resource metadata.

## Endpoints

| Step | Endpoint | Notes |
| --- | --- | --- |
| Register | `POST https://mo.automo.ai/oauth/register` | RFC 7591 dynamic registration, no prior credential. Auth methods: none (public clients) or client_secret_post. |
| Authorize | `GET https://mo.automo.ai/oauth/authorize` | response_type=code, client_id, redirect_uri, code_challenge, code_challenge_method=S256, scope, state. |
| Token | `POST https://mo.automo.ai/oauth/token` | Form-encoded. grant_type authorization_code (with code_verifier) or refresh_token. |
| Userinfo | `GET https://mo.automo.ai/oauth/userinfo` | sub, email and email_verified of the connected person. |

## What the person sees

Signing in uses their normal Automo account (or creating one). The consent screen lists the permissions for the workspace they pick, each as a checkbox, and they can approve a subset. A connection belongs to one workspace; `switch_workspace` moves it to another workspace the same person belongs to.

## Tokens

- Access tokens are bearer tokens: send `Authorization: Bearer …`.
- Ask for `offline_access` to receive a refresh token.
- A refresh that answers `invalid_grant` means the person or an admin disconnected the assistant; start a new authorization.

## Connector keys for servers

For a server-to-server integration with no person in the loop, a workspace admin can mint a key in Settings, Developer, Claude Connector, API tokens, choosing its scopes. Keys start with `edh_`, belong to one workspace, act as the admin who minted them, and work everywhere an access token does.

Machine-readable walkthrough: [auth.md](https://automo.ai/auth.md).