TKP Documentation

Appearance

Sign in with OAuth ​

OAuth lets a client request access to TKP through your browser. You sign in to TKP and choose what the client may access, rather than copying a Personal Access Token into its configuration. For the client-setup steps below, choose an MCP client that supports browser authorization. Applications using only REST can also use OAuth; they do not need to implement MCP.

Connect a client ​

  1. In the client, add a remote MCP server using {APP_URL}/mcp. Replace {APP_URL} with the TKP application address, such as https://tkp.example.com.
  2. Start the client's sign-in or authorization flow. It discovers TKP's sign-in endpoints and registers itself automatically; you do not need to create a client ID or secret first.
  3. In the browser, sign in to TKP. Check the workspace and select the client's permissions. Start with read for one library if you only need search.
  4. Approve the request. The client receives an access token for MCP requests and a refresh token for renewing access. It manages those tokens for you.
  5. Return to the client and confirm that TKP's tools are available.

See Client setup for client-specific steps. If your client cannot complete browser authorization, use a Personal Access Token.

Manage an authorized client ​

In TKP, open API access → Connected Apps. You can change the connection's interfaces and permissions or disconnect it. Disconnecting revokes its access and refresh tokens immediately without signing you out of TKP in the browser.

Implement OAuth in your application ​

A client library with OAuth support can discover TKP's authorization endpoints from:

text
{APP_URL}/.well-known/oauth-protected-resource
{APP_URL}/.well-known/oauth-authorization-server

TKP supports automatic client registration at {APP_URL}/oauth/register using Dynamic Client Registration. Your application must complete the authorization-code flow with PKCE, a check that protects the exchange of the sign-in code for tokens. The OAuth scope tells TKP which interface the token is intended to use: request api:use for REST, mcp:use for MCP, or both if needed. The user must also enable those interfaces and grant library permissions on the consent screen. Store the resulting tokens and refresh them when required. Merely sending a client's MCP URL to a model provider does not perform that browser flow on your behalf.

Traceable Knowledge Platform