Authentication
Every request carries a bearer token in the Authorization header:
Authorization: Bearer igw_live_...Never put a token in a URL, query string or log.
Choose a method
Section titled “Choose a method”| Method | Use it for | Token lifetime |
|---|---|---|
| Installation token | Server integrations and AI agents run by your own team | Until the credential expires, is rotated or is revoked |
| OAuth client credentials | Servers that prefer short-lived tokens bound to one interface | 15 minutes at most |
| OAuth authorization code with PKCE | Hosted web applications that need an organization admin’s explicit consent | 15 minutes at most, with optional refresh for up to 8 hours |
All three use the same credential from Create an app and a credential. Whatever the method, a token can never exceed its credential’s websites, scopes and data access.
Discovery metadata
Section titled “Discovery metadata”These endpoints need no authentication. OAuth-aware clients use them to find the token endpoint and the scopes each resource supports.
| Endpoint | Describes |
|---|---|
GET /.well-known/oauth-authorization-server |
Authorization, token and revocation endpoints, grant types and supported scopes |
GET /.well-known/oauth-protected-resource |
The REST resource |
GET /.well-known/oauth-protected-resource/mcp |
The MCP resource |
GET /.well-known/oauth-protected-resource/a2a |
The A2A resource and the scopes A2A skills use |
An unauthenticated MCP request returns 401 with a WWW-Authenticate: Bearer resource_metadata="..." header that points at the MCP metadata.
Scopes and permissionsScopes, data access flags, restrictions and author mappings.
OAuth endpoint referenceEvery parameter and response of the token, authorize and revoke endpoints.