> ## Documentation Index
> Fetch the complete documentation index at: https://docs.notifique.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth

> Connect third-party apps and AI assistants with OAuth 2.1 — user approves, you get a temporary token.

<Tip>
  OAuth is a **borrowed badge**: the user logs in at Notifique, picks a workspace, and authorizes what your app can do — without sharing an API key.
</Tip>

## What is it?

Lets **third-party apps**, browser integrations, and AI hosts (ChatGPT, Claude, Gemini) call the API **on behalf of a user**.

* Issuer: `https://api.notifique.dev`
* **PKCE required** (S256)
* Dynamic Client Registration (DCR)

| Situation                       |  OAuth  |  API Key |
| ------------------------------- | :-----: | :------: |
| Third-party app with user login | **Yes** |    No    |
| ChatGPT / Claude via MCP        | **Yes** | Optional |
| CI/CD, cron, your backend       |    No   |  **Yes** |

## Metadata (discovery)

| Route                                         | Use                                             |
| --------------------------------------------- | ----------------------------------------------- |
| `GET /.well-known/oauth-authorization-server` | authorize, token, register URLs (RFC 8414)      |
| `GET /.well-known/jwks.json`                  | Public keys to validate JWT                     |
| `GET /.well-known/oauth-protected-resource`   | MCP discovery (`https://mcp.notifique.dev/mcp`) |

## Short flow

1. `POST /oauth/register` — register client (DCR)
2. Redirect user to `/oauth/authorize` with PKCE
3. User approves scopes in browser
4. `POST /oauth/token` — exchange `code` + `code_verifier`
5. Call `/v1/*` with `Authorization: Bearer <access_token>`

## Workspace OAuth apps (API v1)

Manage apps **created in the workspace dashboard** (different from DCR at `/oauth/register` for MCP hosts):

| Method         | Route                                    | Scopes                                  |
| -------------- | ---------------------------------------- | --------------------------------------- |
| GET            | `/v1/oauth/apps`                         | `oauth_apps:read`                       |
| POST           | `/v1/oauth/apps`                         | `oauth_apps:manage`                     |
| GET/PUT/DELETE | `/v1/oauth/apps/{id}`                    | `oauth_apps:read` / `oauth_apps:manage` |
| POST           | `/v1/oauth/apps/{id}/rotate-secret`      | `oauth_apps:manage`                     |
| GET            | `/v1/oauth/connections`                  | `oauth_apps:read`                       |
| POST           | `/v1/oauth/connections/{grantId}/revoke` | `oauth_apps:manage`                     |

For DCR client registration (ChatGPT, Claude, MCP integrations), use `POST /oauth/register` — see [OAuth Quick Start](/en/oauth-api/como-funciona/quick-start).

## Full guide

* [OAuth introduction](/en/oauth-api/como-funciona/introducao)
* [OAuth Quick Start](/en/oauth-api/como-funciona/quick-start)
* [OAuth scopes](/en/oauth-api/como-funciona/escopos)

## Next steps

* [Platform introduction](/en/platform-api/como-funciona/introducao)
* [API keys](/en/guides/api-key/index): when OAuth is not needed