OAuth 2.1 for Assistants & Agents
How an assistant discovers Seayora's sign-in, the authorization-code flow with PKCE, dynamic registration, token refresh and revocation.
Discovery
An unauthenticated call to https://seayora.com/mcp answers 401 with a WWW-Authenticate header pointing at the protected-resource document. That single header is what lets a client bootstrap the whole flow from nothing but the server URL.
| Document | URL |
|---|---|
| Protected resource metadata | https://seayora.com/.well-known/oauth-protected-resource |
| Authorization server metadata | https://seayora.com/.well-known/oauth-authorization-server |
| Authorize | https://seayora.com/oauth/authorize |
| Token | https://seayora.com/oauth/token |
| Dynamic registration | https://seayora.com/oauth/register |
| Revoke | https://seayora.com/oauth/revoke |
The flow
Standard OAuth 2.1 authorization code with PKCE. Register dynamically at /oauth/register (RFC 7591 — no pre-shared client id needed), send the user to /oauth/authorize, exchange the returned code at /oauth/token.
- PKCE is mandatory and must be S256 — plain is rejected.
- Redirect URIs match exactly, with no prefix matching.
- Authorization codes are single-use.
- Refresh tokens rotate on every use, so the one you present dies as you use it.
- A refresh may narrow scope but never widen it. Revoke at /oauth/revoke (RFC 7009).
POST https://seayora.com/oauth/token
Content-Type: application/x-www-form-urlencoded
grant_type=authorization_code
&code=sy_ac_…
&client_id=sy_client_…
&code_verifier=<the original verifier>
&redirect_uri=<must match the authorize request exactly>The consent screen
The consent screen is the only place your account grants anything to a third party. Its terms are served by Seayora, shown before any credential exists, and recorded when you accept — a connection cannot be created without that record. You can uncheck any permission the assistant asked for; it receives only what you leave checked.
Related guides
Related features and guides
- Connecting Claude, ChatGPT or Your Own Agent — Documentation. Step-by-step instructions for connecting Claude, ChatGPT, an MCP-capable agent framework, or plain HTTP software to your Seayora account.
- MCP Server Reference — Documentation. Transport, protocol versions, and the full generated catalog of tools, resources and prompts the Seayora MCP server offers.
- API Authentication & API Keys — Documentation. The three credentials Seayora accepts, live versus test keys, what a credential can see, and how to keep keys safe.
- Rent Autopay and ACH Debits: The Federal Authorization Rules — Guide. What Regulation E requires before rent is debited automatically: a signed authorization, a copy, stop-payment rights and notice when the amount changes.
- Team Roles & Permissions (RBAC) — Feature. Role-based access control with employee accounts, so leasing agents, maintenance staff, and bookkeepers each see only their scope. Every action is audit-logged.
- NYC Landlord Compliance Calendar: Annual Deadlines and Notices — Guide. The yearly obligations of a New York City landlord in one calendar: lead and window guard notices, registration, bedbug filings, heat season and more.