For client developers

The server implements the 2026-07-28 MCP revision over Streamable HTTP and is fully stateless — no initialize handshake required, no session affinity. Older clients using the 2025-era initialize handshake are still served.

Authorization follows the MCP spec: OAuth 2.1 with PKCE (S256 only), audience binding via RFC 8707 resource indicators, and RFC 9728 protected resource metadata. An unauthenticated request gets a 401 with a WWW-Authenticate challenge pointing at the metadata document, which is the intended discovery entry point:

https://mcp.savee.com/.well-known/oauth-protected-resource

That names https://savee.com as the authorization server, whose metadata lives at:

https://savee.com/.well-known/oauth-authorization-server

Clients should register using Client ID Metadata Documents — an HTTPS URL serving your client metadata, used directly as your client_id. Dynamic Client Registration is also supported for clients that predate that mechanism, but it's deprecated in the spec and we'd rather you didn't.

Tokens are bound to this server specifically. A token issued for a different resource is rejected, and the resource parameter is required on both the authorization and token requests.

On disconnect, POST the user's refresh token to the RFC 7009 revocation endpoint advertised as revocation_endpoint in the authorization server metadata:

POST https://savee.com/api/oauth/revoke/
Content-Type: application/json

{ "token": "…", "token_type_hint": "refresh_token", "client_id": "…" }

Revoking a refresh token revokes its entire rotation chain, so the matching access tokens stop working immediately. Per the RFC, an unknown or already-revoked token returns 200 — the caller's intent already holds.

Rate limits match the REST API: 60 requests per minute and 5,000 per hour, keyed on the access token. Exceeding either returns 429 with a Retry-After header.

On this page