Authentication

This reference is expanding.

For integrations today, prefer the standards-based MCP server auth flow.

MCP clients

MCP clients authenticate with OAuth 2.1 + dynamic client registration, and receive a bearer token scoped to a single business and an approved set of scopes. The full flow — discovery, registration, consent, and revocation — is documented in the MCP server reference.

The web app

The Zoie web app authenticates users with an access token sent as a Authorization: Bearer <token> header, refreshed automatically using an HttpOnly refresh cookie managed by the backend. Access tokens are held in memory only (never in local storage), and refresh happens transparently before expiry.

Authenticated requests also carry contextual headers — the acting user and the selected business — so the backend can scope responses correctly.

Coming soon

• First-party API tokens for server-to-server use
• Detailed token lifecycle and refresh semantics