OAuth and credential lifecycle

Integration steps

1. Public assistant clients use PKCE S256. Register exact HTTPS callback URIs or a supported published client identity; broad redirect patterns are refused.
2. The consent page shows the requesting client and scopes. A missing authenticated user cannot approve a grant.
3. Bind tokens to the MCP resource. Developer credentials may call REST; an MCP OAuth token does not silently gain REST authority.
4. Refresh rotation and reuse detection end compromised token families. Revoking a credential, disconnecting an assistant or deleting an account ends linked access.
5. Use recent authentication for sensitive account operations. Store credentials in a server-side secret manager and never expose them in NEXT_PUBLIC_ variables or browser bundles.