# Automate Your Portfolio OAuth 2.0

Automate Your Portfolio protects its Streamable HTTP MCP server with OAuth 2.0 Authorization Code flow and PKCE. AI clients discover the active authorization and token endpoints from `/.well-known/oauth-authorization-server`.

## Machine-readable scopes

- `app:mcp` — connect to this app's MCP server and use only the tools approved by the user.
- `offline` — request refresh-token access when a client needs to reconnect after the current session.

The `app:mcp` grant does not bypass app permissions. The consent screen lists the concrete tools being granted, and every tool still runs with the signed-in user's existing permissions. Read-only portfolio, market, and investor tool groups are documented in the OpenAPI specification.

## Authorization flow

1. Discover authorization-server metadata at `/.well-known/oauth-authorization-server`.
2. Create an Authorization Code request with the `app:mcp` scope and PKCE using `S256`.
3. Send the user to the discovered authorization endpoint.
4. The user signs in and reviews the requested tools.
5. Exchange the returned code at the discovered token endpoint.
6. Send the access token in the HTTP `Authorization: Bearer` header.

Never request or collect the user's eToro password, eToro API key, or Base44 session token.