PortalFirma

MCP · OAuth

OAuth 2.0

Authorization Server público en api-integration (issuer). Resource Server en api-mcp. api solo es backend interno (DB oauth, mint, validate).

Discovery resource: https://mcp.portalfirma.cl/.well-known/oauth-protected-resource

Discovery AS: https://integracion.portalfirma.cl/.well-known/oauth-authorization-server

Hosts

arquitectura
Authorization Server  →  https://integracion.portalfirma.cl  (api-integration)
Resource Server       →  https://mcp.portalfirma.cl/api/mcp  (api-mcp)
Backend interno       →  api  (/api/oauth-as/*, mint, validate)

Flujo

  1. 1.Cliente llama MCP (api-mcp) sin token → 401 + WWW-Authenticate (resource_metadata).
  2. 2.Lee /.well-known/oauth-protected-resource → authorization_servers (= api-integration).
  3. 3.Lee AS metadata en api-integration → authorize, token, register; PKCE S256.
  4. 4.Opcional: POST /oauth/register (DCR) en el issuer.
  5. 5.Browser: GET /oauth/authorize en api-integration + login partner.
  6. 6.Redirect con ?code=…
  7. 7.POST /oauth/token (authorization_code + code_verifier) → access_token + refresh_token.
  8. 8.POST /api/mcp con Authorization: Bearer pf_mcp_at_*.

Registrar cliente (DCR)

curl · /oauth/register
curl -X POST https://integracion.portalfirma.cl/oauth/register \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "Claude",
    "redirect_uris": ["https://claude.ai/api/mcp/auth_callback"]
  }'

Refresh

grant_type=refresh_token rota el refresh en el issuer. App-company no usa este flujo: api mintea Bearer en el backend con la sesión JWT del portal.