nuvouch
Home
§ MCP · Controlled beta

Official OAuth-protected MCP

The Nuvouch MCP is the hosted path for OAuth-capable agent clients. The client registers with Nuvouch, completes authorization with PKCE, pairs a hosted runtime through the user's trusted mobile device, then calls /mcp with an OAuth bearer token.

§ MCP · Discovery

Discover OAuth and MCP metadata

GET/.well-known/oauth-authorization-server
GET/.well-known/oauth-protected-resource/mcp
GET/mcp
discovery.sh
curl
curl "https://api.nuvouch.com/.well-known/oauth-authorization-server"
curl "https://api.nuvouch.com/.well-known/oauth-protected-resource/mcp"
curl "https://api.nuvouch.com/mcp"
FieldTypeDescription
authorization_endpointurlOAuth authorization endpoint. Currently /oauth/authorize.
token_endpointurlOAuth token endpoint. Currently /oauth/token.
registration_endpointurlDynamic client registration endpoint. Currently /oauth/register.
resourceurlProtected MCP resource URL. Currently /mcp.
scopes_supportedarrayControlled-beta scopes include identity and delegation.
§ MCP · Registration

Register an OAuth client

POST/oauth/register
register-client.sh
dynamic registration
curl -X POST "https://api.nuvouch.com/oauth/register" \
  -H "content-type: application/json" \
  -d '{
    "client_name": "Acme Agent Client",
    "redirect_uris": ["https://agent.example.com/oauth/callback"],
    "provider_id": "generic",
    "scope": "identity delegation",
    "token_endpoint_auth_method": "none"
  }'
§ MCP · Authorization

Authorize with PKCE and mobile pairing

GET/oauth/authorize

Start an authorization-code flow with code_challenge_method=S256. If the user is already signed in and explicitly session-authorizes, Nuvouch can bind the OAuth client to an existing runtime connection. Otherwise the authorization page renders a hosted MCP pairing QR.

authorize-url.txt
example
https://api.nuvouch.com/oauth/authorize?response_type=code
  &client_id=nvr_client_123
  &redirect_uri=https%3A%2F%2Fagent.example.com%2Foauth%2Fcallback
  &scope=identity%20delegation
  &code_challenge=BASE64URL_SHA256_VERIFIER
  &code_challenge_method=S256
  &state=opaque_state
  1. Nuvouch creates a hosted MCP runtime pairing session.
  2. The user scans the QR in Nuvouch mobile and receives a pairing code.
  3. The user enters that code on the authorization page.
  4. Nuvouch claims the runtime connection and redirects with an authorization code.
§ MCP · Tokens

Exchange, refresh, and revoke tokens

POST/oauth/token
exchange-token.sh
authorization_code
curl -X POST "https://api.nuvouch.com/oauth/token" \
  -H "content-type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=authorization_code" \
  --data-urlencode "client_id=nvr_client_123" \
  --data-urlencode "redirect_uri=https://agent.example.com/oauth/callback" \
  --data-urlencode "code=nvr_code_123" \
  --data-urlencode "code_verifier=ORIGINAL_PKCE_VERIFIER"
refresh-token.sh
refresh_token
curl -X POST "https://api.nuvouch.com/oauth/token" \
  -H "content-type: application/x-www-form-urlencoded" \
  --data-urlencode "grant_type=refresh_token" \
  --data-urlencode "client_id=nvr_client_123" \
  --data-urlencode "refresh_token=nvr_refresh_123"
POST/oauth/revoke
revoke-token.sh
curl -X POST "https://api.nuvouch.com/oauth/revoke" \
  -H "content-type: application/json" \
  -d '{ "token": "nvr_access_or_refresh_token", "client_id": "nvr_client_123" }'
§ MCP · Tools

Call identity and delegation tools

POST/mcp
tools-list.json
JSON-RPC
{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/list"
}
FieldTypeDescription
identity_gettoolReturns pairwise Nuvouch identity for the authenticated OAuth runtime.
delegation_requesttoolCreates a scoped delegation request and waits for approval by default.
delegation_statustoolChecks or waits for an existing delegation and returns a token when approved.
delegation_revoketoolRevokes an active or pending delegation for the OAuth runtime.

Request delegation

delegation-request.json
tools/call
{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "delegation_request",
    "arguments": {
      "audienceId": "aud_test_payments",
      "purpose": "Identify the user before preparing a payment approval.",
      "scopes": ["payments.identity", "payments.prepare"],
      "waitForApproval": true
    }
  }
}