OAuth apps for custom MCP clients

AtomicMCP is not limited to Claude or ChatGPT. Any application that implements the Model Context Protocol Streamable HTTP transport can connect to AtomicMCP after registering an MCP-specific OAuth app.

These applications are separate from Atomicat API keys or any future general-purpose API OAuth clients.

Security model

AtomicMCP custom clients use:

• OAuth 2.0 Authorization Code flow.
• Public clients without a client secret.
• PKCE with the S256 challenge method.
• Refresh-token rotation.
• Exact HTTPS callback URL matching.
• Callback-domain ownership verification.
• Explicit, least-privilege scopes.

The scopes selected while registering an app are its maximum allowed scopes. The client must still explicitly request the scopes needed for each authorization. AtomicMCP does not automatically grant every allowed scope.

Register an app

1. Open Settings → Integrations in Atomicat.
2. Under AtomicMCP OAuth Apps, select Create app.
3. Enter a recognizable application name.
4. Add every exact production callback URL.
5. Select the maximum scopes this client may request.
6. Save the app and securely copy its public Client ID and verification challenge.

See Register and verify an MCP OAuth app for the complete procedure.

OAuth and MCP endpoints

Purpose	Endpoint
Authorization	https://mcp.atomicat.com.br/oauth/authorize
Token exchange and refresh	https://mcp.atomicat.com.br/oauth/token
Token revocation	https://mcp.atomicat.com.br/oauth/revoke
MCP Streamable HTTP	https://mcp.atomicat.com.br/mcp
OAuth resource	https://mcp.atomicat.com.br

Use the exact callback URL saved in Atomicat. The authorization request must include response_type=code, the public client_id, callback URL, requested scopes, PKCE challenge, code_challenge_method=S256, state, and the AtomicMCP resource.

Scopes

Available scope groups include account, projects, pages, sites, leads, forms, video, templates, media, funnels, analytics, and recommendations.

If an app allows sites pages but requests only sites, the resulting grant and tokens receive only sites. Requesting a scope that is not allowed causes authorization to fail.

Changing an app's allowed scopes does not modify existing grants. Update the client's requested scopes, disconnect the existing connection, and authorize again.

Connected apps and revocation

Users can review connected MCP clients in Settings → Integrations → Apps connected to your account. Disconnecting an app invalidates its active MCP grant and refresh tokens. The client must complete authorization again before it can call tools.

Revoking the registered OAuth app prevents new authorizations and disconnects its grants. Revoked registrations are retained for audit purposes but are not returned to the normal app-management interface.

Related docs

• Register and verify an MCP OAuth app
• AtomicMCP overview
• MCP tools and categories
• AtomicMCP security

Frequently asked questions

Can an internal application connect to AtomicMCP?+

Yes. Any client that supports MCP Streamable HTTP and the required OAuth Authorization Code with PKCE flow can register an app and connect.

Does a public client receive a client secret?+

No. AtomicMCP custom clients are public clients and use PKCE S256 instead of relying on a browser-distributed secret.

Does enabling a scope automatically grant it?+

No. Enabled scopes define the maximum the app may request. Each authorization request must explicitly ask for the required subset.

Do scope changes affect existing tokens?+

No. Disconnect the existing grant and authorize again with the updated requested scopes.