Skip to main content
Flowy ships a hosted MCP server at:
It speaks Streamable HTTP (the current MCP transport) and authenticates over OAuth. No API key to copy anywhere. Point a compatible agent at the URL, sign in and consent once in the browser, and the connection is bound to your Flowy account: by default every tool call acts in and bills your personal account wallet, and can act in any workspace you can manage by passing a workspace_id (from list_workspaces).

Discovery flow

An MCP client never needs the OAuth details hardcoded. It discovers them from the server itself, per the MCP authorization spec:
1

Unauthenticated request

The client POSTs to /mcp with no bearer token.
2

401 challenge

The server responds 401 with a WWW-Authenticate: Bearer resource_metadata="…" header pointing at its protected-resource metadata.
3

Protected-resource metadata (RFC 9728)

The client fetches that URL and reads authorization_servers (which authorization server to use) and scopes_supported.
4

Authorization-server metadata (RFC 8414)

The client fetches /.well-known/oauth-authorization-server on that authorization server (mirrored on the MCP server’s own origin) to learn the authorize, token, and registration endpoints.
5

Dynamic client registration (RFC 7591)

The client registers itself against the registration endpoint and gets back a client_id, with no manual app setup required.
6

Authorize with PKCE

The client opens the authorize URL with a PKCE challenge. You sign in (if needed) and see the consent screen: the same one described in OAuth apps, and approve.
7

Token exchange

The client exchanges the authorization code for an access token at the token endpoint.
8

Retry with the bearer

The client retries the original /mcp request with Authorization: Bearer <token>, and the session proceeds normally.
Every step above is automatic in an MCP-native client (Claude, Claude Code, Cursor, ChatGPT). You only ever interact with the sign-in + consent screen in step 6.

Scopes

The server requests this fixed set of scopes on every connection, matching the backend’s registration ceiling for MCP clients, so a client that requests exactly these gets the full tool surface below, flow creation included: apps:read · apps:write · runs:read · runs:write · generations:read · generations:write · assets:read · credits:read
This scope set is specific to the MCP server’s client registration. It isn’t the same list a third-party OAuth app can request from the console (that list adds elements:read / elements:write and omits apps:write).

Tools

The server exposes 38 tools, grouped by what they work with:

Connect from your agent

Or run it for you with the CLI: flowy mcp install --client claude.
Any other MCP-capable client can connect the same way: point it at https://mcp.tryflowy.ai/mcp over Streamable HTTP and let it run the discovery flow above.
Last modified on August 29, 2026