DaleaGuide
Authentication
Every call runs as a signed-in Dalea user. Clients get a token through OAuth, or send an API key when they cannot run OAuth.
OAuth 2.1
The server uses OAuth 2.1 with PKCE (S256) and dynamic client registration, so clients register themselves on first use.
Discovery follows the MCP authorization spec: an unauthenticated request gets a 401 with a WWW-Authenticate header pointing at the protected resource metadata, which points at the authorization server metadata.
- Authorization server
- https://app.usedalea.ai
- Resource metadata
- https://app.usedalea.ai/.well-known/oauth-protected-resource/api/mcp/mcp
Scopes
| Scope | Grants |
|---|---|
dalea:read | Read brands, content, calendar, metrics, references and brand knowledge. |
dalea:write | Create and edit content, brand knowledge and references, and run AI actions that consume daily quota. |
offline_access | Keep the connection alive with a refresh token so the client does not ask you to log in again. |
If a connection was authorized with dalea:read only, write tools answer with a message asking you to reconnect with write access.
API keys
API keys start with dalea_mcp_ and are sent as Authorization: Bearer <key>. Each account can have up to 10 active keys.
Revoking access
Revoke OAuth connections and API keys at any time in Dalea under Settings, MCP.