OAuth Authorization
How an MCP client obtains and refreshes a token for the Rekamedika MCP server.
The MCP worker is both an OAuth server (to your MCP client) and an OAuth client (to better-auth on api.rekamedika.com). You only interact with the first half; the upstream leg is handled for you.
Discover
Fetch https://mcp.rekamedika.com/.well-known/oauth-authorization-server
(RFC 8414). It advertises the authorization_endpoint, token_endpoint, and
registration_endpoint below.
Register your client (RFC 7591)
POST https://mcp.rekamedika.com/register with your client metadata
(redirect URIs, name). Dynamic registration is open; no pre-shared secret is
required for public clients.
Authorize (authorization code + PKCE S256)
Send the operator to https://mcp.rekamedika.com/authorize. The worker
forwards to the API's /api/auth/oauth2/authorize, where the operator signs
in passwordlessly (passkey / magic link / email OTP) on the Rekamedika
dashboard. The MCP worker is registered as better-auth's trusted client,
so no consent screen is shown for it; other OAuth clients (e.g. ones you
register dynamically against the API's /oauth2/* surface) go through the
consent page.
Exchange the code
POST https://mcp.rekamedika.com/token with the authorization code and your
PKCE verifier. You receive an access token (15-minute TTL) and a refresh
token.
Call the MCP endpoint
Use the access token as Authorization: Bearer <token> against
https://mcp.rekamedika.com/mcp. On refresh, the worker transparently
refreshes its own upstream token as well.
Scopes
The worker advertises openid, profile, email, simrs:read, and
simrs:write (refresh tokens are issued to MCP clients regardless of scope;
offline_access is an upstream API scope the worker requests for itself).
| Scope | Grants |
|---|---|
openid, profile, email | OIDC identity claims |
simrs:read | Read tools (all tRPC queries, SATUSEHAT GETs) |
simrs:write | Write tools — necessary but not sufficient: RBAC roles still apply |
Scope never widens roles
A token with simrs:write still cannot call a write tool unless the
operator actually holds one of the tool's RBAC roles. Scope gates the token;
roles gate the person.
Token lifetimes
- MCP client access token: 15 minutes (refresh with the refresh token).
- Upstream API access token: 1 hour — the worker refreshes it before your token expires, so a live session never sees an upstream 401.
Expired or missing token
POST /mcp without a valid Bearer returns 401 with a WWW-Authenticate
header carrying a resource_metadata hint, which points your client back to
the discovery document — the standard MCP re-authorization path.
Is this page helpful?