Authentication & Scopes

All three Webase MCP endpoints accept the same auth: OAuth 2 bearer tokens (recommended for AI hosts), or an x-api-token header for internal scripts and CI.

OAuth 2 (recommended)

Webase implements OAuth 2 with PKCE. The discovery endpoints below let MCP hosts that follow the OAuth Protected Resource Metadata spec auto-configure with no manual setup.

Authorization URL — https://www.webase.com/oauth/authorize
Token URL — https://www.webase.com/oauth/token
Authorization Server Metadata — https://www.webase.com/.well-known/oauth-authorization-server
Protected Resource Metadata — https://www.webase.com/.well-known/oauth-protected-resource

Pass the access token as Authorization: Bearer <token> on every MCP request.

API token (scripts and CI)

Each Webase user has a long-lived API token visible at Account Settings. Pass it as the x-api-token header. Useful for non-interactive automation.

curl -X POST https://www.webase.com/mcp/managed/messages \
  -H 'Content-Type: application/json' \
  -H 'x-api-token: <your-api-token>' \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

Scopes

Two tool families use distinct scope prefixes. Read tools require any read-or-write scope in the family; write tools require the matching write scope.

App Gen scopes

app_gen_read — list, read source, read evaluations, read records, get preview URL
app_gen_write — create / update / delete applications, write source, manage data models, mutate records, deploy, upload builds

PM scopes

pm_read — list and read projects, features, project memory, context
pm_write — create / update / claim / complete features; update project context

Claude superscope

claudeai grants read and write access across both PM and App Gen. Useful when authoring an OAuth client for an agent that should "do everything."

offline_access

Standard OAuth scope that grants a refresh token alongside the access token. Request it if your MCP host needs to refresh long-running sessions.

Per-endpoint scope behavior

All three endpoints honor the same scope rules — a token granted app_gen_write can call write tools on managed, external, or legacy. The endpoints differ by which tools are registered, not by which scopes they accept.