Authentication

Fanaura uses OAuth so you never paste a password or API key into an assistant. You sign in on a Fanaura page, choose Allow access, and the assistant receives a token that works only for your account.

Endpoints

Purpose	URL
MCP server	`https://app.fanaura.com/mcp`
Protected resource metadata	`https://app.fanaura.com/.well-known/oauth-protected-resource`
Authorization server metadata	`https://app.fanaura.com/.well-known/oauth-authorization-server`
Issuer	`https://app.fanaura.com`
Authorize	`https://app.fanaura.com/oauth/mcp/authorize`
Token	`https://app.fanaura.com/api/oauth/mcp/token`
Dynamic client registration	`https://app.fanaura.com/api/oauth/mcp/register`
Revoke	`https://app.fanaura.com/api/oauth/mcp/revoke`

What Fanaura supports

Grant types

authorization_code and refresh_token.

PKCE

S256 code challenges.

Client authentication

client_secret_post, or none for public clients such as desktop apps.

Bearer tokens

Sent in the Authorization header only.

Return addresses

Desktop apps may use a loopback redirect on localhost, 127.0.0.1, or ::1. HTTPS redirects are allowed for chatgpt.com, openai.com, claude.ai, anthropic.com, cursor.com, and vscode.dev, including their subdomains. The full table is on the developer tools page.

Scopes

When an assistant asks for no scopes, Fanaura grants all three. Scopes it does not recognize are dropped. Every connection today uses all three, and the consent page lists what they allow.

Scope	Covers
`journeys:read`	List journeys, get a journey, check links, validate publish, and read setup status
`journeys:write`	Create, edit, and publish journeys
`audience:read`	Read totals, contacts, timelines, and audience activity

Token lifetimes

Authorization code

10 minutes, single use.

Access token

1 hour. The assistant refreshes it for you.

Refresh token

30 days. The assistant asks you to sign in again after that.

Enter your email and tap Send sign-in code, then enter the code. You can tap Use password instead.

Check the account

Once signed in, the page reads “Signed in as” followed by your email, and lists what the assistant can do.

Allow or cancel

Tap Allow access to connect, Cancel to stop, or Use a different account to sign out and choose another.

If the page reads Connection request invalid, it was opened without the details an assistant sends. Start the connection from your assistant. If it reads Connection not allowed, the assistant’s return address is not on Fanaura’s list. Read allowed return addresses.

Revoke access

From your assistant
From Fanaura support
From code

Disconnect or remove Fanaura in the assistant’s connector settings. The assistant forgets its token. Some assistants also call the revoke endpoint. If you want the token cancelled on Fanaura’s side too, use one of the other two options.

Email support@fanaura.com and name the assistant. Fanaura cancels its tokens. The next request from that assistant gets 401.

curl -X POST https://app.fanaura.com/api/oauth/mcp/revoke \
  -d "token=YOUR_REFRESH_OR_ACCESS_TOKEN" \
  -d "client_id=YOUR_CLIENT_ID"

Confidential clients also send client_secret. Fanaura answers 200 even when the token is unknown or already revoked.

Signing out of Fanaura in your browser does not disconnect an assistant. Its token stays valid until it expires or is revoked.

Overview

Connect your assistant

Guides

Tool reference

Security and data

Endpoints

What Fanaura supports

Grant types

PKCE

Client authentication

Bearer tokens

Return addresses

Scopes

Token lifetimes

Authorization code

Access token

Refresh token

Revoke access

​Endpoints

​What Fanaura supports

Grant types

PKCE

Client authentication

Bearer tokens

​Return addresses

​Scopes

​Token lifetimes

Authorization code

Access token

Refresh token

​The sign-in page

​Revoke access

Endpoints

What Fanaura supports

Return addresses

Scopes

Token lifetimes

The sign-in page

Revoke access