Outborn Agent Platform · Technical reference

Authentication and authorization

Use Outborn Account OAuth for the MCP resource and preserve the authenticated organization's access boundary.

Applied guidance

Best practices for authentication and authorization

Discover the Outborn Account authorization server from the MCP protected-resource metadata and request a token for the advertised resource.
Keep the authenticated user's organization context and required openid and organizations scopes intact.
Handle 401 through the advertised authentication challenge and 403 through scope or access correction; redact tokens from logs.

Avoid

Do not treat a visible UI control as proof of server authorization or substitute an unrelated user's token when access is denied.

Identity and resource ownership

Outborn Account owns sign-in, sessions, organization membership, and OAuth authorization. Outborn Agent Platform authorizes product resources and tool calls in that identity's organization. A client does not choose a different organization merely by adding an ID to a request.

OAuth protected-resource discovery

GET /.well-known/oauth-protected-resource/mcp/v1 on the public MCP origin returns the resource URL, authorization_servers, bearer_methods_supported, and scopes_supported. Use the advertised resource when requesting a token; production rejects a token whose audience is not the exact public /mcp/v1 resource.

Discovery endpointHTTP

01GET /.well-known/oauth-protected-resource/mcp/v102Accept: application/json

Token requirements

MCP requests use Authorization: Bearer <access-token>. The current resource requires openid and organizations scopes. It also validates a signed Outborn Account JWT with an active user, organization_id, client_id, matching issuer and audience, and a valid expiry. A provider API key, session cookie, or token for another Outborn service does not meet this contract.

— Use the authorization server returned by discovery instead of hardcoding a guessed token endpoint.
— Keep the token associated with the current user and organization; do not reuse it across tenants.
— Reauthorize on an expired or invalid token. Correct the grant or organization if access remains denied.

Authenticated MCP requestHTTP

01POST /mcp/v102Authorization: Bearer <access-token>03Content-Type: application/json04
05{06  "jsonrpc": "2.0",07  "id": 1,08  "method": "tools/list"09}

Protect credentials

Store access and refresh credentials in the client environment supported by your OAuth integration. Keep provider secrets out of prompts, URLs, browser-visible documentation examples, and logs. Revoke a compromised connection through the owning account or provider flow and inspect recent activity.