socioi.comDocs
Open App

MCP authentication

API keys and OAuth 2.1 for the Socioi MCP server.

Two ways to authorize MCP clients:

1. API key (Cursor & automation)

  1. https://socioi.com/settings/developers → Access
  2. Generate si_live_…
  3. Send on every MCP request:
Authorization: Bearer si_live_YOUR_KEY

Bearer is recommended. The server also accepts a bare si_live_… or mcp_at_… token.

Rotating the key disconnects every MCP client using the old value.

2. OAuth 2.1 (Claude / ChatGPT)

Hosts discover metadata automatically:

DocumentURL
Protected resourcehttps://socioi.com/.well-known/oauth-protected-resource
Authorization serverhttps://socioi.com/.well-known/oauth-authorization-server

Flow:

  1. Client registers via DCR — POST https://socioi.com/mcp/mcp/oauth/register
  2. User consents at https://socioi.com/mcp/authorize (PKCE S256 required)
  3. Client exchanges the code at POST https://socioi.com/mcp/mcp/oauth/token
  4. Receives mcp_at_… (access) + mcp_rt_… (refresh)

Token behaviour

  • Access tokens expire (default 1 hour)
  • Refresh tokens rotate on use
  • Reusing an old refresh token revokes the whole grant family
  • Revoke anytime under Developers → MCP → Connected clients

Scopes

Default scopes include mcp, posts:read, posts:write, channels:read, media:read, media:write.

What is rejected

CredentialOn /mcp?
si_live_…Yes
mcp_at_…Yes
pos_… (Public API OAuth)No — use Public API
Session JWT (browser login)No

Unauthenticated calls return 401 with WWW-Authenticate pointing at the protected-resource metadata URL.