OAuth and security

​

Discovery

{
  "resource": "https://api.nextlevelmca.com/mcp",
  "authorization_servers": ["https://api.nextlevelmca.com"],
  "scopes_supported": ["businesses:read", "businesses:write", "people:read", "people:write", "deals:read", "deals:write", "documents:read", "documents:write", "lenders:read", "lenders:write", "submissions:write", "offers:read", "offers:write", "advances:read", "advances:write", "portal:send", "webhooks:manage"],
  "bearer_methods_supported": ["header"]
}

{
  "issuer": "https://api.nextlevelmca.com",
  "authorization_endpoint": "https://api.nextlevelmca.com/oauth/authorize",
  "token_endpoint": "https://api.nextlevelmca.com/oauth/token",
  "registration_endpoint": "https://api.nextlevelmca.com/oauth/register",
  "revocation_endpoint": "https://api.nextlevelmca.com/oauth/revoke",
  "jwks_uri": "https://api.nextlevelmca.com/oauth/jwks",
  "response_types_supported": ["code"],
  "grant_types_supported": ["authorization_code", "refresh_token"],
  "code_challenge_methods_supported": ["S256"],
  "token_endpoint_auth_methods_supported": ["none"],
  "scopes_supported": ["businesses:read", "…"]
}

​

Dynamic client registration

​

Authorization flow

1. Authorize. GET /oauth/authorize with response_type=code, client_id, redirect_uri, scope, state, code_challenge, code_challenge_method=S256 and optionally resource. client_id and redirect_uri are validated first; on failure the server renders an error page and never redirects to an unvalidated URI. Only PKCE S256 is accepted; plain is rejected. Request parameters are stored server-side under an opaque request id for 30 minutes, not carried in URLs.
2. Sign in. The user enters their email. If it belongs to an active user, a magic link is sent; the page says “check your email” either way, so addresses cannot be enumerated. Links are single use, expire after 10 minutes, and are limited to 3 per email per 15 minutes. Opening one sets a signed, HttpOnly, Secure, SameSite=Lax session cookie that lives 30 minutes.
3. Location. Users who belong to several locations pick one; users with one location skip this. The grant is pinned to that location.
4. Consent. The user sees the client, the location and each scope in plain words, then approves or denies. An existing, unrevoked consent for the same client, location and scopes skips this step.
5. Code. The server issues an authorization code bound to the client, redirect URI, scopes, location and PKCE challenge. Codes expire after 60 seconds and are single use; presenting a consumed code revokes everything issued from it.
6. Token. POST /oauth/token (JSON or form-encoded) with grant_type=authorization_code, code, redirect_uri, client_id and code_verifier returns an access token, a refresh token, expires_in: 3600 and the granted scope. Limited to 60 requests per minute per IP address.

​

Tokens

​

Scopes and roles

• Scopes limit breadth. They are the resources the connection may touch, chosen at consent. A tool without its scope returns a clear error naming the scope.
• Role limits depth. The connection acts as the signed-in user, with that user’s role from the app: which deals they can see, whether they may withdraw a submission or accept an offer, whether dob is returned. Scopes can never grant more than the user’s role allows.

​

Tenant isolation

​

Revoking access

• Settings → Developers → Connected apps in the app lists each consent for the location with the user, client, scopes, when it was granted and last used. Revoke deletes the consent and every refresh-token family for that user, client and location. Outstanding access tokens expire within the hour and cannot be refreshed.
• Clients can call POST /oauth/revoke with a refresh token to revoke its family.
• Removing the connector inside Claude or ChatGPT discards the client’s tokens but leaves the consent in place; revoke in the app as well when offboarding.
• Deactivating the user in the app invalidates all of their tokens immediately.