# Pear MCP auth.md

Pear MCP requires a user-controlled credential before an agent can access the user's connected provider data. This document describes the supported authentication paths; it does not create an automated agent-registration endpoint.

## OAuth for compatible clients

Pear supports OAuth Authorization Code with PKCE for compatible preregistered public clients and clients identified by a valid Client ID Metadata Document.

1. Read protected-resource metadata at https://pearmcp.com/.well-known/oauth-protected-resource.
2. Read authorization-server metadata at https://pearmcp.com/.well-known/oauth-authorization-server.
3. Start authorization at https://pearmcp.com/oauth/authorize using a supported Client ID, exact redirect URI, PKCE S256 challenge, requested scope, and the Pear MCP resource https://pearmcp.com/api/mcp.
4. The user signs in, connects a provider if needed, reviews the requested permissions, and approves the client.
5. Exchange the authorization code at https://pearmcp.com/oauth/token.

Pear does not expose open Dynamic Client Registration. Do not invent a Client ID or submit a Pear API key as a Client ID or client secret.

## User-provisioned API key

If the client supports bearer-token configuration, the user can sign in at https://pearmcp.com/login and obtain an API key from https://pearmcp.com/dashboard/settings?tab=access. Send the key only in the HTTP Authorization header as a Bearer token.

Never print, log, or place the key in shared configuration. The user can rotate the key from Pear Settings.

## MCP resource

- Endpoint: https://pearmcp.com/api/mcp
- Transport: Streamable HTTP
- Documentation: https://pearmcp.com/docs
- Supported scopes are published in the protected-resource and authorization-server metadata.