Authentication

The MCP server and the API are both OAuth 2.1 resource servers. A client gets an access token from emely’s authorization server and sends it as a bearer token.

Authorization server

The authorization server is Nhost Auth, the same service that signs users in to the emely app.

• Issuer: https://<auth-host>/v1
• Flow: authorization code with PKCE
• Client registration: client id metadata documents (CIMD). The client id is an HTTPS URL that hosts the client’s metadata.
• Login and consent UI: https://app.emely.io/consent

The MCP server publishes its authorization server in the protected-resource metadata at https://mcp.emely.io/.well-known/oauth-protected-resource, including the path-scoped URL https://mcp.emely.io/.well-known/oauth-protected-resource/mcp.

Required scope

Clients request:

openid graphql:role:api_operator

graphql:role:api_operator restricts the token to a single Hasura role. Both servers reject any token whose allowed roles are not exactly api_operator. A token minted without the restriction carries the account’s full roles and is refused. Do not request the plain graphql scope together with graphql:role:api_operator; the server refuses the combination.

Tokens

• Access tokens are JWTs signed with RS256 and expire after 15 minutes.
• Refresh tokens expire after 30 days.
• The token carries the caller’s user id. Every write is attributed to that user.