Authentication & Scopes

All three Webase MCP endpoints accept the same auth: OAuth 2 bearer tokens (recommended for AI hosts), or an x-api-token header for internal scripts and CI.

OAuth 2 (recommended)

Webase implements OAuth 2 with PKCE. The discovery endpoints below let MCP hosts that follow the OAuth Protected Resource Metadata spec auto-configure with no manual setup.

Authorization URL — https://www.webase.com/oauth/authorize
Token URL — https://www.webase.com/oauth/token
Authorization Server Metadata — https://www.webase.com/.well-known/oauth-authorization-server
Protected Resource Metadata — https://www.webase.com/.well-known/oauth-protected-resource

Pass the access token as Authorization: Bearer <token> on every MCP request.

API token (scripts and CI)

Each Webase user has a long-lived API token visible at Account Settings. Pass it as the x-api-token header. Useful for non-interactive automation.

curl -X POST https://www.webase.com/mcp/managed/messages \
  -H 'Content-Type: application/json' \
  -H 'x-api-token: <your-api-token>' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Scopes

Two tool families use distinct scope prefixes. Read tools require any read-or-write scope in the family; write tools require the matching write scope.

App Gen scopes

app_gen_read — list, read source, read evaluations, read records, get preview URL
app_gen_write — create / update / delete applications, write source, manage data models, mutate records, deploy, upload builds

offline_access

Standard OAuth scope that grants a refresh token alongside the access token. Request it if your MCP host needs to refresh long-running sessions.

Per-endpoint scope behavior

All three endpoints honor the same scope rules — a token granted app_gen_write can call write tools on managed, external, or unified. The endpoints differ by which tools are registered, not by which scopes they accept.