Authentication

Manage predefined OAuth clients and troubleshoot the separate MCP and LLM protected resources.

Separate resource audiences

https://backplane.gsmlg.net/mcp and https://backplane.gsmlg.net/v1 are separate OAuth audiences. Resource-bound OAuth access tokens are audience-specific: a token issued for one resource is not valid for the other. PAT and legacy credentials follow the configured compatibility policy.

Predefined clients and PKCE

Use predefined OAuth clients. ChatGPT uses a confidential client with its exact registered callback and PKCE S256; the client secret is displayed only once.

Refresh and revocation

A refresh token request that omits resource inherits its original resource, supporting durable ChatGPT connectivity across reconnects. Revoke access at https://backplane.gsmlg.net/oauth/revoke.

HTTPS and troubleshooting

OAuth protected resources require HTTPS outside the explicit local development override. invalid_target means the requested resource is missing, repeated, unsupported, or disallowed; invalid_token means the bearer token is invalid or bound to the wrong audience; insufficient_scope means the valid token lacks the required operation scope.

Setup

Create a predefined confidential client, keep PKCE S256 enabled, register exact redirect URIs, and assign one or both protected resources.
Assign matching client scopes and user scopes before starting authorization.
Use the same resource during authorization and code exchange. On refresh, omit resource to inherit the original binding or supply that same exact value.
Revoke tokens when access should end, and use the returned OAuth error names to diagnose failed requests.

Examples

Protected resource audiences

MCP_RESOURCE=https://backplane.gsmlg.net/mcp
LLM_RESOURCE=https://backplane.gsmlg.net/v1

Revoke a token

curl -X POST https://backplane.gsmlg.net/oauth/revoke \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  --data-urlencode "token=$ACCESS_TOKEN"

OAuth error guide

invalid_target      check the exact resource value
invalid_token       obtain a token for the requested audience
insufficient_scope request and grant the required scope

Reference


                  GET /oauth/authorize


                  POST /oauth/token


                  POST /oauth/revoke


                  GET /.well-known/oauth-protected-resource/mcp


                  GET /.well-known/oauth-protected-resource/v1