jeCheckDevelopers
Get an API key
Developers/AI & MCP

OAuth for AI apps

AI apps such as claude.ai and ChatGPT connect to the jeCheck MCP server with OAuth 2.1 — the user signs in to jeCheck and approves access, no token copying needed. jeCheck implements the MCP authorization spec: protected-resource metadata (RFC 9728), authorization-server metadata (RFC 8414), dynamic client registration (RFC 7591), authorization code with PKCE S256 and rotating refresh tokens.

Most developers never touch this — MCP clients do it automatically. This page is for those building their own client.

Endpoints

URL
Protected resource metadata https://app.jecheck.io/.well-known/oauth-protected-resource
Authorization server metadata https://app.jecheck.io/.well-known/oauth-authorization-server
Registration POST https://app.jecheck.io/oauth/register
Authorization GET https://app.jecheck.io/oauth/authorize
Token POST https://app.jecheck.io/oauth/token
Revocation POST https://app.jecheck.io/oauth/revoke

Scopes: read, write. The user can deny write on the consent screen — check the scope field of the token response.

Flow

1. Discover

An unauthenticated call to https://app.jecheck.io/mcp returns:

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://app.jecheck.io/.well-known/oauth-protected-resource"

The resource metadata names the authorization server; its metadata lists all endpoints.

2. Register the client

curl -X POST https://app.jecheck.io/oauth/register \
  -H "Content-Type: application/json" \
  -d '{"client_name": "My agent", "redirect_uris": ["https://agent.example.com/callback"], "token_endpoint_auth_method": "none"}'

{ "client_id": "jck_app_9f3k…", "redirect_uris": ["https://agent.example.com/callback"], "token_endpoint_auth_method": "none" }

Redirect URIs must be https, loopback http (http://127.0.0.1:PORT/… for desktop apps) or a custom app scheme. Confidential clients may request client_secret_post or client_secret_basic and receive a secret.

3. Send the user to authorize

https://app.jecheck.io/oauth/authorize?response_type=code
  &client_id=jck_app_9f3k…
  &redirect_uri=https://agent.example.com/callback
  &scope=read%20write
  &state=af0ifjsldkj
  &code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
  &code_challenge_method=S256

The user signs in to jeCheck (if needed) and sees what the app asks for. After approval jeCheck redirects to redirect_uri?code=…&state=…&iss=…; on refusal — error=access_denied.

4. Exchange the code

curl -X POST https://app.jecheck.io/oauth/token \
  -d grant_type=authorization_code \
  -d code=SplxlOBeZQQYbYS6WxSbIA \
  -d client_id=jck_app_9f3k… \
  -d redirect_uri=https://agent.example.com/callback \
  -d code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk

{
  "access_token": "jck_oat_…",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "jck_ort_…",
  "scope": "read write"
}

Codes are single-use and expire after 10 minutes.

5. Refresh

curl -X POST https://app.jecheck.io/oauth/token \
  -d grant_type=refresh_token \
  -d refresh_token=jck_ort_… \
  -d client_id=jck_app_9f3k…

Each refresh returns a new refresh token and invalidates the old one together with its access token. Refresh tokens expire after 30 days of inactivity.

6. Revoke

curl -X POST https://app.jecheck.io/oauth/revoke -d token=jck_oat_…

Users can also disconnect apps in API & MCP → AI apps.

Using the token

OAuth access tokens work for both the MCP server and the REST API, with the permissions of the user who approved the connection.

Errors

Token-endpoint errors follow RFC 6749: {"error": "invalid_grant", "error_description": "…"} with 400 (or 401 invalid_client).