From 923e6a0939b3814a90f56a20d75f21f67da76dac Mon Sep 17 00:00:00 2001 From: chrisjleal <184772742+chrisjleal@users.noreply.github.com> Date: Sat, 7 Nov 2026 14:03:22 -0600 Subject: [PATCH] Say where sign-in starts and where the anonymous surface lives Adding Proofable now asks you to sign in straight away, because the host endpoint challenges an absent credential on every method. The four keyless tools and the unauthenticated handshake live on /mcp/public, which is what a directory listing and an account-free check use. --- mcp/auth.mdx | 4 +++- mcp/oauth.mdx | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/mcp/auth.mdx b/mcp/auth.mdx index ed4e1a8..c14fb45 100644 --- a/mcp/auth.mdx +++ b/mcp/auth.mdx @@ -22,7 +22,7 @@ The terminal installer writes the same URL: npx -y @proofable/sdk setup ``` -A signed-out connection can complete the handshake, list every tool, and run `proofable_context`, `proofable_verifiers_catalog`, `proofable_proofs_check` and `proofable_verify_or_guide`. Calling any other tool returns `401` with a `WWW-Authenticate` challenge, which starts the host's OAuth flow (DCR, PKCE and token exchange). Claude shows a **Connect** button in the chat and runs the same call once you sign in. In Claude Code, run `/mcp`. In Codex, run `codex mcp login proofable`. +Adding Proofable to a client asks you to sign in straight away. A request with no credential returns `401` with a `WWW-Authenticate` challenge on every method, `initialize` included, and that challenge is what opens the host's OAuth flow (DCR, PKCE and token exchange). Claude shows a **Connect** button in the chat and runs the call once you sign in. In Claude Code, run `/mcp`. In Codex, run `codex mcp login proofable`. ```http HTTP/1.1 401 Unauthorized @@ -31,6 +31,8 @@ WWW-Authenticate: Bearer resource_metadata="https://mcp.proofable.me/mcp/.well-k An expired or invalid Bearer gets the same challenge on every request, including `initialize`, so OAuth-capable hosts refresh silently. The endpoint is stateless streamable HTTP: GET and DELETE on `/mcp` return `405` without a challenge. +Without an account, `proofable_context`, `proofable_verifiers_catalog`, `proofable_proofs_check` and `proofable_verify_or_guide` run on `https://mcp.proofable.me/mcp/public`. That is the anonymous surface directory listings and account-free checks use. Anything that needs a profile is challenged there too, so a client that lands on it signs in and moves to `/mcp`. + [MCP OAuth](./oauth) covers discovery, token exchange and scopes. ## Access key (servers and automation) diff --git a/mcp/oauth.mdx b/mcp/oauth.mdx index 782cdfe..2c419af 100644 --- a/mcp/oauth.mdx +++ b/mcp/oauth.mdx @@ -49,7 +49,7 @@ GET https://mcp.proofable.me/.well-known/oauth-protected-resource/mcp } ``` -A signed-out handshake, the full tool list and the four signed-out tools answer normally. Calling any other tool without a usable token returns the challenge that starts DCR and PKCE, and the host signs in and retries that call. An access key uses the same URL as a Bearer token. +A request with no credential, on any method including `initialize`, returns the challenge that starts DCR and PKCE, so the first sign-in happens when you add the connector. An access key uses the same URL as a Bearer token. The anonymous surface at `https://mcp.proofable.me/mcp/public` serves the handshake, the advertised tool list and the four keyless tools for directory listings and account-free checks. ```http HTTP/1.1 401 Unauthorized