AI SEO Tracker MCP is an OAuth resource. The authorization server is Better Auth at /api/auth. Clients discover metadata at /.well-known/oauth-protected-resource/api/agent/mcp.
There are no personal access tokens or API keys for MCP. If a client asks you to paste a secret into mcp.json, you are in the wrong flow.
What happens
- The client POSTs to the MCP URL without a token.
- The server returns 401 with
WWW-Authenticateand a JSON body (error: "agent_auth_required"). - The client starts authorization code + PKCE in a browser.
- You sign in (same account as the website) and Allow on
/consent. - The client stores the access token and retries MCP.
Scopes
| Scope | Purpose | When requested |
|---|---|---|
openid | Identify the user | Always |
profile | Display name | Always |
email | Account email | Always |
offline_access | Refresh token | Always |
Audience is the MCP resource URL (https://aiseotracker.com/api/agent/mcp in production). A token minted for localhost will 401 against production, and the reverse.
401 is expected
A 401 on the first call is not a bug. It starts OAuth. After you Allow, retries should succeed.
If you still get 401 after signing in, the token is missing, expired, or minted for a different resource URL. Reconnect from Agent settings. See Troubleshooting.
Consent
If the client sends no display name, the consent page may say “MCP client”. You can still Allow. That is not a failed login.
Access
You copy the URL from /p/{projectSlug}/settings/agent. After login, tools can read every project that user can open, not only the project whose settings page you used.
Revoke
Open /account/agents and revoke a client. Settings → Agents in the app also links there. After revoke, the next MCP call 401s until you connect again.
You can also disconnect from the MCP client. Either side is enough.