# Authentication

> OAuth 2.1 with dynamic client registration, and what each advertising scope grants.

[Documentation](https://www.getmcpads.com/docs)

## How a client connects

The endpoint speaks OAuth 2.1. Given only the URL, a client bootstraps itself: it receives a 401 carrying a `WWW-Authenticate` header, reads the protected resource metadata, registers itself, and walks the authorisation flow with PKCE.

| Document | URL |
| --- | --- |
| Protected resource metadata (RFC 9728) | https://mcp.getmcpads.com/.well-known/oauth-protected-resource |
| Authorization server metadata (RFC 8414) | https://mcp.getmcpads.com/.well-known/oauth-authorization-server |
| Dynamic client registration (RFC 7591) | Advertised in the metadata above |
| MCP manifest | https://www.getmcpads.com/.well-known/mcp |

> **Note** There is no API key. A key is a bearer credential that lives in a `.env` file forever; an OAuth session is revocable and bound to the accounts you ticked.

## What the gateway asks each platform

A scope is what the platform grants. It is not what the gateway does with it. Where a platform publishes no read-only scope, the restriction is enforced here instead: on the Free plan no write tool is announced, and calling one is refused before it reaches the platform.

Requested scopes, by source

| Source | Scope | Grants | Writes |
| --- | --- | --- | --- |
| Meta Ads | `ads_read` | Read Meta campaigns, insights, creatives and audiences. | No |
| Meta Ads | `ads_management` | Pause, resume and change budgets on Meta campaigns, ad sets and ads. Only reachable on a paid plan. | Yes |
| Pinterest Ads | `ads:read` | Read Pinterest campaigns, ad groups, ads and analytics. | No |
| Pinterest Ads | `ads:write` | Pause, resume and change budgets on Pinterest campaigns. Only reachable on a paid plan. | Yes |
| Google Ads | `https://www.googleapis.com/auth/adwords` | Read and write on Google Ads. Google publishes no read-only alternative, so read-only enforcement is done by this gateway, not by Google. | Yes |
| TikTok Ads | none in the authorization URL | TikTok attaches permissions to the app in Business Center. | n/a |
| Search Console | `https://www.googleapis.com/auth/webmasters.readonly` | Read Search Console performance, index coverage and sitemaps. Cannot modify anything. | No |
| Google Analytics 4 | `https://www.googleapis.com/auth/analytics.readonly` | Read GA4 reports, metadata and property configuration. Cannot modify anything. | No |

- [scopes.md](https://www.getmcpads.com/scopes.md): The same table, as Markdown.
- [/.well-known/oauth-scopes](https://www.getmcpads.com/.well-known/oauth-scopes): The same table, as JSON.
- [Account scoping](https://www.getmcpads.com/docs/concepts/accounts): What the gateway enforces on top of the scope.

---

This page as HTML: https://www.getmcpads.com/docs/authentication
Every page under /docs is available as Markdown: append `.md`, or send `Accept: text/markdown`.