# Authentication

The server uses OAuth 2.1 with PKCE (S256) and dynamic client registration, so clients register themselves on first use.

Discovery follows the MCP authorization spec: an unauthenticated request gets a 401 with a WWW-Authenticate header pointing at the protected resource metadata, which points at the authorization server metadata.

Authorization server: https://app.usedalea.ai. Protected resource metadata: https://app.usedalea.ai/.well-known/oauth-protected-resource/api/mcp/mcp.

| Scope | Grants |
| --- | --- |
| `dalea:read` | Read brands, content, calendar, metrics, references and brand knowledge. |
| `dalea:write` | Create and edit content, brand knowledge and references, and run AI actions that consume daily quota. |
| `offline_access` | Keep the connection alive with a refresh token so the client does not ask you to log in again. |

If a connection was authorized with dalea:read only, write tools answer with a message asking you to reconnect with write access.

API keys start with `dalea_mcp_` and are sent as `Authorization: Bearer <key>`. Each account can have up to 10 active keys.

Revoke OAuth connections and API keys at any time in Dalea under Settings, MCP.