Connector OAuth

When you need this

A key is the right credential for a client you configure yourself: Claude Code, Cursor, a script, anything that can send Authorization: Bearer. Mint one under Settings → MCP and follow the MCP reference.

A connector directory cannot send a header you typed. It signs in instead. Tempio is both the MCP resource server and the OAuth 2.1 authorization server, so the client discovers, registers and authorizes against the same origin it calls tools on. Keys and connectors work side by side; neither replaces the other.

The flow

The client calls the MCP endpoint with no token. Tempio answers 401 with a WWW-Authenticate header naming the protected-resource document.
It reads that document, and the authorization-server document it points at.
It registers itself (dynamic client registration) and gets a client id. Registration grants nothing on its own.
It sends you to Tempio to sign in and consent. You choose the workspace and the scopes.
It exchanges the authorization code for an access token and calls tools with it.

Discovery

Two documents, both public and both at the origin root:

https://app.tempio.ai/.well-known/oauth-protected-resource
https://app.tempio.ai/.well-known/oauth-authorization-server

The MCP endpoint itself is https://app.tempio.ai/api/mcp (streamable HTTP).

What a client registers

POST to the registration endpoint the authorization-server document names, per RFC 7591. Registration is open to any client:

Public clients only in practice — send token_endpoint_auth_method: "none" and hold no secret.
redirect_uris is required, and the redirect used at authorization must be one of them exactly.
PKCE is required, and S256 is the only code challenge method. A plain challenge is refused.
grant_types: authorization_code and, with the offline_access scope, refresh_token.

A registration is a name and a redirect URI. No token exists until a person signs in and consents.

Consent is where a connection gets its workspace. The screen names the client, lists what it will be able to do, and asks you to pick one workspace — a chooser when you belong to several, drawn from your own memberships.

That choice is the binding. A token reaches exactly one workspace for the life of the connection; it is never taken from a tool argument, a URL or the workspace you happen to be looking at in the app. Connect the same client to a second workspace and you consent again, which replaces the first connection rather than adding to it — the older token stops working.

Scopes

Scope	What it allows
`tempio:read`	Connections, ad accounts, campaigns, structure, media assets, media plans, performance. Always granted.
`tempio:draft`	Create and edit change requests. A draft moves no spend on its own.
`tempio:approve`	Apply drafts to the live platforms. A separate tick, off by default, offered only to an owner or admin of the chosen workspace — and held only while you hold that role.
`offline_access`	Issue a refresh token, so the connector stays connected without sending you back to sign in.

Scopes map one to one onto the scopes a key carries, so a connector and a key with the same scopes can do exactly the same things.

Lifetimes

Token	Lifetime
Authorization code	10 minutes, single use
Access token	1 hour
Refresh token	30 days, rotated on each use

Every call re-reads your membership of the bound workspace. Leaving the workspace, or having the membership removed, refuses the connector's next call — the same rule keys follow. A change of role narrows the connection rather than ending it: lose owner or admin and tempio:approve is gone from the very next call, while the connector goes on reading and drafting. Nothing is re-consented for that to take effect.

Revoking

Settings → MCP → Connectors lists every connection this workspace has authorized, with its client, its scopes, when it was added and when it was last used. Revoke refuses the next call it makes, access token and refresh token alike: both are deleted, not merely marked. Connecting the same client again starts from the consent screen, so you choose the workspace and the scopes over. Anyone who can mint a key can revoke a connection.

When a connector says it cannot find the authorization server

Work down this list:

Check the endpoint you gave it. It must be the MCP endpoint, https://app.tempio.ai/api/mcp, not the discovery URL and not the app's home page.
Fetch the two discovery documents yourself. Both must return JSON to a signed-out request. HTML means something in front of Tempio is redirecting them to a sign-in page.
Check the origin. Self-hosted or preview deployments serve both documents from whatever origin they are configured with; a connector that was pointed at one origin and redirected to another will refuse the mismatch.
Send it back through registration. A client registered against a different origin holds a client id this one has never seen, and the authorization request fails as an unknown client.
Check the redirect URI. It has to match one the client registered, character for character.

If a connector still cannot complete the handshake, a bearer key works with any client that can send an Authorization header.

On this page