# PicYep MCP: signing in

How a client gets a token for the server at https://picyep.com/mcp.

## Find out where

1. POST any JSON-RPC message to https://picyep.com/mcp. Without a token the answer is 401.
2. Its WWW-Authenticate header names the protected-resource metadata: https://picyep.com/.well-known/oauth-protected-resource/mcp
3. That names the authorization server, whose metadata is at https://picyep.com/.well-known/oauth-authorization-server/api/auth

## Register

POST to https://picyep.com/api/auth/oauth2/register (RFC 7591). Clients register as public clients, with PKCE. Any scope sent while registering is left out; scopes are asked for at the authorization step.

## Sign in

Send the person to https://picyep.com/api/auth/oauth2/authorize with response_type=code, code_challenge, code_challenge_method=S256, redirect_uri, resource=https://picyep.com/mcp and scope.

- `photos`: see the balance and models, make photos with the account’s credits, and use photos added through a link.
- `library`: see, change and delete saved photos, people and albums, and make public links to photos.
- `offline_access`: a refresh token.

They sign in to PicYep, or make an account, and see a page naming the client and where it sends them back. A client running on their own computer is pointed out as one.

## Get a token

POST the code to https://picyep.com/api/auth/oauth2/token, form-encoded, with code_verifier and the same resource. An access token lasts an hour. A refresh token changes with each use, and using an old one ends the connection.

## Use it

Send `Authorization: Bearer <access_token>` with every POST. A person can disconnect a client in Settings, under Connected apps, and asking to delete their account also ends it. Both take effect at once.