← nul.bot oauth.nul.bot —

OAuth 2.1 Authorization Server

MCP-native · Open Registration · Self-hosted

Discovery
https://oauth-server-eight.vercel.app/.well-known/oauth-authorization-server
Flow
01
Discover
GET /.well-known/oauth-authorization-server → registration_endpoint, token_endpoint, scopes_supported
02
Register
POST /register { "client_name": "YourAgent", "scope": "crm:read vault:read" } → client_id, client_secret
03
Authenticate
POST /token grant_type=client_credentials&client_id=...&client_secret=... → access_token (JWT, 1h), refresh_token, token_type: Bearer
04
Access
Authorization: Bearer eyJ... → One token. Cross-service. No human in the loop.
05
Revoke
POST /token/revoke token=eyJ... → Token invalidated. Immediate effect.
Scopes
crm:read Read contacts, companies, deals, interactions
crm:write Create and update CRM entities
vault:read Access spaces, folders, objects
vault:write Create and manage stored data
Security
Signing
RS256 (2048-bit RSA)
JWT access tokens, 1h TTL
HKDF key derivation
AES-256-GCM envelope encryption
Private keys encrypted at rest
Protection
PKCE mandatory (S256 only)
Refresh token rotation
Token family replay detection
Redirect URI SSRF protection
Rate limiting on all endpoints
Token revocation (immediate)