# auth.md

Mora agent authentication and connection guide.

Mora's public marketing pages and Discover feed do not require credentials.
The authenticated MCP server is:

- Endpoint: https://app.mora-marketer.com/api/mcp
- Transport: Streamable HTTP, JSON-RPC POST
- Protected-resource metadata: https://app.mora-marketer.com/.well-known/oauth-protected-resource
- Authorization-server metadata: https://app.mora-marketer.com/.well-known/oauth-authorization-server
- Authorization: OAuth 2.1 authorization-code flow with PKCE S256
- Client registration: Client ID Metadata Documents (CIMD); Mora does not currently expose Dynamic Client Registration
- Scope: mora.read
- Public Claude Code connector: https://github.com/jut147/mora-claude-plugin
- Public MCP architecture and contract guide: https://github.com/jut147/mora-claude-plugin/blob/master/docs/mcp-architecture.md

The server is read-only and scoped to the signed-in account that grants access.
It does not publish, schedule, connect accounts, change billing, or write a brand kit.
Never paste a Mora session token into source control, a shared prompt, or a client configuration file.

The public GitHub repository is a connector and documentation package only. The canonical MCP
implementation is hosted at https://app.mora-marketer.com/api/mcp; agents must use the live
OAuth metadata and server card rather than treating the GitHub repository as the API endpoint.

The hosted endpoint is stateless: GET and DELETE return 405 with Allow: POST, OPTIONS, and OPTIONS is the
CORS preflight. This is separate from browser WebMCP, which is an optional, signed-in, consent-gated app
capability and is not discovered through this HTTP endpoint.

## Browser WebMCP

In a compatible browser, the signed-in Mora app can offer one separate WebMCP tool named **get_brand_profile** after an explicit consent prompt. It is read-only and account-scoped. The consent state and the tool's execution guard can be revoked from Settings > Profile > Browser agent access. WebMCP browser access is not a replacement for the OAuth flow above.

## Consent and revocation

The account owner must complete the browser consent flow. Use the client-approved redirect URI and PKCE verifier. Revoke access from the Mora account security controls when available; report suspected credential exposure immediately to security@mora-marketer.com.

## Public documentation

- https://www.mora-marketer.com/developers/mcp
- https://app.mora-marketer.com/.well-known/mcp/server-card.json
- https://www.mora-marketer.com/llms.txt
- https://github.com/jut147/mora-claude-plugin
- https://github.com/jut147/mora-claude-plugin/blob/master/docs/mcp-contract.json