docs(mcp): platform runbook — managed token + authorize URL + curl reference#346
Merged
Merged
Conversation
…rize URL (#343) Update the platform-integrator runbook for the managed authorize_endpoint contract (#343). Adds the deploy-time platform block (token_endpoint + authorize_endpoint + agent_identity), a "two platform endpoints" section documenting both request/response shapes ({server, subject} → token / 401-parks; {server, subject} → {authorize_url}), and a "two delivery models" comparison (Forge-delivers-over-Slack vs platform-delivers). Notes the token/refresh-token boundary, the https authorize_url requirement, the durable A2A-artifact record, and the Cancel fast-fail. Refreshed the migration checklist.
…L + curl Update docs/mcp/delegated-consent.md for the managed authorize_endpoint flow (#343): the deploy-time platform block (token_endpoint + authorize_endpoint + agent_identity), a "two platform endpoints" section documenting both request/ response shapes ({server, subject} → token / 401-parks; → {authorize_url}), a curl reference for both endpoints + the /mcp/consent resume, and a "two delivery models" comparison (Forge-delivers-over-Slack vs platform-delivers). Refreshed the migration checklist.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the platform-integrator runbook (
docs/mcp/delegated-consent.md) for the managed delegated-consent flow — how a platform enables the auth gate, provides the access token, and provides the authorization URL, with a curl reference for every call.What's added
token_endpoint+authorize_endpoint+agent_identity, and what activates the gate (auth.type: user).{server, subject}(Bearer agent identity + tenancy headers):token_endpoint→200 {access_token, expires_in}when granted;401/403/404= "no grant yet" which trips the gate. Never returns the refresh token.authorize_endpoint→{authorize_url}built with the platform's ownclient_id/redirect_uri/state/PKCE (Forge treats it opaque;https-only; the code + refresh token land at the platform's callback).token_endpoint,authorize_endpoint, and thePOST /mcp/consentresume.authorize_endpoint+--with slack) vs platform-delivers (consumemcp_auth_required); either way token custody stays with the platform.Notes
authorize_endpointcontract implemented in Forge-driven Slack delivery of MCP consent prompts (channel-adapter ConsentDeliverer) #343 (PR feat(mcp): Forge-driven Slack delivery of MCP consent prompts (#343) #345) — merge alongside it. (The runbook was moved here out of feat(mcp): Forge-driven Slack delivery of MCP consent prompts (#343) #345 so the two PRs don't both touch this file; feat(mcp): Forge-driven Slack delivery of MCP consent prompts (#343) #345 keeps the code +configuration.mdconfig reference.)