# auth.md — Authentication for Agents

Zapier uses OAuth 2.0 Authorization Code with PKCE (S256). Request only the scopes your agent needs.

## Discovery

- `mcp.zapier.com/.well-known/oauth-authorization-server` — RFC 8414 authorization server metadata
- `mcp.zapier.com/.well-known/oauth-protected-resource/api/v1/connect` — RFC 9728 protected resource metadata

## Authorization Flow (PKCE)

**1. Generate a code verifier and challenge**

```
code_verifier  = base64url(random_bytes(32))
code_challenge = base64url(sha256(code_verifier))
```

**2. Redirect the user to the authorization endpoint**

```
GET https://mcp.zapier.com/oauth/authorize?
  response_type=code
  &client_id=YOUR_CLIENT_ID
  &redirect_uri=YOUR_REDIRECT_URI
  &scope=openid+profile+email
  &code_challenge=CODE_CHALLENGE
  &code_challenge_method=S256
  &state=RANDOM_STATE
```

**3. Exchange the code for tokens**

```
POST https://mcp.zapier.com/api/v1/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=AUTHORIZATION_CODE
&redirect_uri=YOUR_REDIRECT_URI
&client_id=YOUR_CLIENT_ID
&code_verifier=CODE_VERIFIER
```

For confidential clients (with a client secret), also include `&client_secret=YOUR_CLIENT_SECRET`. Public clients using PKCE should omit it.

**4. Call a protected endpoint**

```
GET https://mcp.zapier.com/api/v1/connect
Authorization: Bearer ACCESS_TOKEN
```

## Token Refresh

```
POST https://mcp.zapier.com/api/v1/oauth/token
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token
&refresh_token=REFRESH_TOKEN
&client_id=YOUR_CLIENT_ID
&client_secret=YOUR_CLIENT_SECRET
```

For public clients using PKCE, omit `client_secret`.

## Token Revocation

```
POST https://mcp.zapier.com/api/v1/oauth/revoke
Content-Type: application/x-www-form-urlencoded

token=TOKEN
&client_id=YOUR_CLIENT_ID
&client_secret=YOUR_CLIENT_SECRET
```

For public clients using PKCE, omit `client_secret`.

## Scopes

The authorization server advertises the following scopes (see its `scopes_supported` metadata):

| Scope | Description |
|-------|-------------|
| `openid` | OpenID Connect authentication (required) |
| `profile` | Basic profile information |
| `email` | Email address |

## Register an Application

The authorization server supports OAuth 2.0 Dynamic Client Registration (RFC 7591):

- `POST https://mcp.zapier.com/api/v1/oauth/register`

## Further Reading

- MCP quickstart: https://docs.zapier.com/mcp/quickstart
- API authentication: https://docs.zapier.com/powered-by-zapier/authentication/getting-started