MCP OAuth Authorization Consolidation

Status

Phase 1: ✅ Bearer token auth working (current token revoked 2026-08-07 for security)

Phase 2: ⏳ TODO (move OAuth to webdav.critchley.biz as unified auth host)

Phase 1 — Bearer Token Auth

• Misc MCP server at https://www.critchley.biz/misc/mcp/ requires OAuth
• Registered OAuth client: codex-22TxT9wY3Xp5_0Tu1WLtSQBX (with PKCE + basic auth flow)
• Generated bearer token via PKCE flow (30-day TTL)
• ✅ All MCP connectors connected (notes, private notes, misc, Google services)
• ✅ Bearer token tested: SSE endpoint responding with regular pings
• Token revoked 2026-08-07 for security — stored in /home/john/.claude.json as reference but no longer valid

Phase 2 — Consolidate to Single .netrc Entry (TODO)

Goal: Use webdav.critchley.biz as unified auth host for all services (Misc OAuth + WebDAV + future)

Steps

1. SSH to gravlax.critchley.biz (or use sudo locally)
2. Update /etc/gdata_oauth_misc.env: change OAUTH_AUTHORIZATION_ENDPOINT to https://webdav.critchley.biz/misc/oauth/authorize
3. Optionally update OAUTH_ISSUER to https://webdav.critchley.biz (or keep https://www.critchley.biz if reverse proxy handles it)
4. Restart misc-mcp-server systemd service
5. Re-run OAuth flow with webdav credentials from ~/.netrc (john / jsrc271828+)
6. Update Claude Code MCP config with new bearer token

Why

Single ~/.netrc entry (webdav.critchley.biz) covers Misc OAuth + WebDAV + future services. Cleaner than managing separate hostnames.

Current Setup (Phase 1)

• Authorization endpoint: https://webdav.critchley.biz/misc/oauth/authorize (protected by Apache Basic Auth)
• Token endpoint: https://www.critchley.biz/misc/oauth/token
• Revocation endpoint: https://www.critchley.biz/misc/oauth/revoke
• Token type: Bearer (30-day TTL)
• Current status: Previous token revoked 2026-08-07 — new token required to re-enable Misc MCP

Blockers

• Phase 2 blocked on sudo access to /etc/gdata_oauth_misc.env on gravlax