Any application can ask a RandallFlare user for permission and receive tokens: to read or change their resources through the API, to open their private apps, or just to know who they are (OpenID Connect). MCP clients such as Claude or Cursor do this on their own when they meet a private MCP server on RandallFlare. The discovery documents live at /.well-known/oauth-authorization-server, /.well-known/openid-configuration and /.well-known/jwks.json.
# 1. Register once (or use a client you created under Account → Connected apps)
curl -s https://randallflare.com/oauth/register -H 'content-type: application/json' \
-d '{"client_name":"My agent","redirect_uris":["http://127.0.0.1:8765/cb"]}'
# → { "client_id": "…", "token_endpoint_auth_method": "none", … }
# 2. Send the user to consent (PKCE: S256 of a 43-128 char verifier)
https://randallflare.com/oauth/authorize?response_type=code&client_id=…&redirect_uri=http://127.0.0.1:8765/cb
&scope=openid%20profile%20read%20write%20offline_access&code_challenge=…&code_challenge_method=S256&state=…
# 3. Exchange the code
curl -s https://randallflare.com/oauth/token -d grant_type=authorization_code -d client_id=… \
-d code=… -d redirect_uri=http://127.0.0.1:8765/cb -d code_verifier=…
# → { "access_token": "eyJ…", "refresh_token": "…", "id_token": "eyJ…", "expires_in": 3600 }
# 4. Call the API or the MCP server with it
curl -s https://randallflare.com/api/edge/v1/whoami -H 'authorization: Bearer eyJ…'
Authorization code with PKCE (S256) is required; public clients have no secret. Refresh tokens rotate; reusing an old one revokes the whole family.
Scopes: openid, profile, email (identity), account (who am I), read, write (the REST API and the MCP server), app (open a private app), offline_access (refresh tokens), agent (machine clients).
The consent screen is skipped for scopes the user already granted the client. Consents are listed under Account → Connected apps and can be revoked there.
Working in a shared workspace? The token acts on that workspace's resources (owner claim), with the user's role there.
Name a private app's address as the resource and the access token's audience becomes that app. The edge gate accepts it as a Bearer header, so MCP servers and APIs you build on RandallFlare need no login page of their own; the app sees the user in RF-Access-User-Id and RF-Access-User-Email. A 401 from a private app carries WWW-Authenticate: Bearer resource_metadata=…, which is how MCP clients find this authorization server.
bash
# A token for one private app: name it as the resource
curl -s https://randallflare.com/oauth/token -d grant_type=authorization_code … \
-d resource=https://notes.edge.randallflare.com
# The access token's audience is that app; send it as a Bearer header and the gate lets you in
curl https://notes.edge.randallflare.com/mcp -H 'authorization: Bearer eyJ…'
A client registered while signed in may use client_credentials and the agent scope. Its tokens act for the owner's account (with read/write) and, with resource=human-check, pass the Human check on any site: the site's server receives success: true and the agent's client id instead of a browser puzzle.
bash
# A machine client (registered while signed in, with client_credentials)
curl -s -u "$CLIENT_ID:$CLIENT_SECRET" https://randallflare.com/oauth/token \
-d grant_type=client_credentials -d scope=agent -d resource=human-check
# Send the token where a browser would send the human-check response:
curl https://your-site.example/form -d token=eyJ… # your server's siteverify call succeeds with "agent": "client:…"
Passkeys: under Account → Security, add a passkey for this device; then sign in with your screen lock or security key instead of a password or email code. bigrandall.io and randallflare.com keep separate passkeys.
One account works on both sites; a private app sends you to whichever already has your session.
Access tokens are EdDSA JWTs signed by the platform (/.well-known/jwks.json), valid for an hour; id_tokens carry nonce, name, preferred_username, email and picture as the scopes allow.