workspace_id (from list_workspaces).
Discovery flow
An MCP client never needs the OAuth details hardcoded. It discovers them from the server itself, per the MCP authorization spec:1
Unauthenticated request
The client
POSTs to /mcp with no bearer token.2
401 challenge
The server responds
401 with a WWW-Authenticate: Bearer resource_metadata="…" header pointing at its protected-resource metadata.3
Protected-resource metadata (RFC 9728)
The client fetches that URL and reads
authorization_servers (which
authorization server to use) and scopes_supported.4
Authorization-server metadata (RFC 8414)
The client fetches
/.well-known/oauth-authorization-server on that
authorization server (mirrored on the MCP server’s own origin) to learn
the authorize, token, and registration endpoints.5
Dynamic client registration (RFC 7591)
The client registers itself against the
registration endpoint and gets
back a client_id, with no manual app setup required.6
Authorize with PKCE
The client opens the
authorize URL with a PKCE challenge. You sign in
(if needed) and see the consent screen: the same one described in
OAuth apps, and approve.7
Token exchange
The client exchanges the authorization code for an access token at the
token endpoint.8
Retry with the bearer
The client retries the original
/mcp request with
Authorization: Bearer <token>, and the session proceeds normally.Every step above is automatic in an MCP-native client (Claude, Claude Code,
Cursor, ChatGPT). You only ever interact with the sign-in + consent screen
in step 6.
Scopes
The server requests this fixed set of scopes on every connection, matching the backend’s registration ceiling for MCP clients, so a client that requests exactly these gets the full tool surface below, flow creation included:apps:read · apps:write · runs:read · runs:write ·
generations:read · generations:write · assets:read · credits:read
This scope set is specific to the MCP server’s client registration. It
isn’t the same list a third-party OAuth app can
request from the console (that list adds
elements:read /
elements:write and omits apps:write).Tools
The server exposes 38 tools, grouped by what they work with:Community (3)
Community (3)
Canvas (6)
Canvas (6)
Generation (5)
Generation (5)
Assets (2)
Assets (2)
Account & billing (4)
Account & billing (4)
Projects (2)
Projects (2)
Brand kits (6)
Brand kits (6)
Renders (3)
Renders (3)
Flows (5)
Flows (5)
Skills (2)
Skills (2)
Connect from your agent
- Claude Code
- Cursor
- Claude / Claude Desktop
- ChatGPT
- VS Code
flowy mcp install --client claude.