Business discovery, with evidence

Saka OAuth and MCP authentication

Connect an authorized client

Saka uses OAuth authorization code flow with PKCE, not a separate API-key issuing service. Use an MCP client that supports OAuth. For purchasing, enter https://saka.run/api/mcp as its server URL and complete the browser authorization flow with your own Saka account. Quotes are free; purchases need prepaid credit and a user-approved spending cap.

Resource discovery and audiences

Purchasing resource metadata identifies the authorization server. Read that server’s OAuth discovery document and use its advertised endpoints; do not guess them. Send resource=https://saka.run/api/mcp in authorization and token requests. Use a cryptographically random state and PKCE verifier, S256 challenge, and the same registered redirect URI throughout the flow. Request the supported scopes advertised by discovery, including openid; identity scopes such as email and profile do not grant a spending budget.

The read-only library is a separate audience: https://saka.run/api/library/mcp. Its resource metadata describes that connector. A library token cannot be used for purchasing, and a purchasing token cannot substitute for a library token. The owner can disable connected-agent purchasing access in the account page without authorizing new spending.

Use the token and inspect MCP tools

Send the user-consented access token in Authorization: Bearer TOKEN. The token must match the server’s resource audience and must not be an ID token. Follow the MCP initialize and initialized handshake before requesting tools/list. Purchasing tools are saka_quote, saka_purchase and saka_balance. The library connector exposes retrieval of the owner’s existing purchases. Authentication remains required on both servers.

A 401 supplies protected-resource metadata through WWW-Authenticate. Reauthorize with the correct resource if a token is expired, revoked, has a different audience, or the owner has disabled purchasing access. Keep tokens out of URLs, screenshots, shared logs and source code. No anonymous scan can verify your account’s protected tools or permissions. The OpenAPI authentication schemes and API reference provide the current contract.