Authorization
Marque uses AT Protocol OAuth for identity and a separate OAuth grant for MCP access. The MCP client never receives the user’s PDS access token.
Connection flow
- The client discovers authorization from
https://marque.at/mcp. - Marque sends the user through the existing AT Protocol sign-in flow.
- The user reviews the requesting client and requested scopes.
- Marque issues credentials bound to the MCP resource and client.
- Each tool call checks the OAuth scopes and the user’s current domain authority.
Marque requires PKCE S256, exact redirect matching, and the resource indicator https://marque.at/mcp. Access tokens are short-lived; refresh tokens rotate and are revoked on replay.
Two authorization layers
Every domain action must pass both layers:
| Layer | What it controls |
|---|---|
| OAuth scope | Which categories of tools the connected client may call |
| Domain authority | Which domains and operations the signed-in DID may access as owner or team member |
For example, dns.write lets a client request DNS changes. A delegated team member still needs dns.records.write for the specific domain. OAuth can never elevate a member beyond the owner’s grant.
Owner-only actions remain owner-only, including renewals, auto-renewal and privacy changes, and team mutations.
Discovery endpoints
Clients discover the protected resource and authorization server from:
https://marque.at/.well-known/oauth-protected-resource/mcp
https://marque.at/.well-known/oauth-authorization-serverMarque supports HTTPS Client ID Metadata Documents and Dynamic Client Registration for compatible clients.
Revoke access
Open Marque settings and find Connected agents. Revoking an agent ends its grant, invalidates active token families, and expires checkout requests that are still awaiting approval. It does not cancel checkouts that have already entered payment or provisioning, remove domain data, or revoke other agents.
See OAuth scopes for the least-privilege mapping from tasks to scopes.