Authentication and Discovery

Authentication and Discovery

Protected resource metadata

Discover metadata at:

https://batoi.com/.well-known/oauth-protected-resource/mcp/{workspace_uid_or_slug}

The document identifies the resource URL, supported bearer method, scopes, authorization servers when configured, and this documentation. OAuth clients must follow the advertised authorization-server metadata and applicable PKCE and refresh-token policies.

Credentials

Send the registered host credential in the Authorization bearer header. The endpoint validates the workspace, credential hash, active host, active integration, capability class, and policy state.

Tokens obtained for another resource or downstream system must not be passed through to this endpoint. The Batoi host retains connector credentials; they are never supplied to the model or generated code.

Discovery

The anonymous endpoint description does not publish a tool catalog. After authentication:

• tools/list returns only tools permitted by the host capability.
• resources/list returns only approved resources permitted for that host.
• Unknown and unauthorized capabilities use the same non-disclosing error posture.