# MCP sign-in: OAuth and tokens

> How an MCP client signs in to Slicer — OAuth 2.1 with a consent screen, access and spend limits, token lifetimes, API tokens and details for client developers.

Source: https://docs.slicer.media/en/mcp/authentication/

The MCP server accepts two kinds of sign-in. **OAuth** — the client opens a browser, you sign in to Slicer and allow access; the client gets and refreshes its token by itself. **API token** — you create a token in your profile and pass it to the client in the `Authorization: Bearer slc_…` header. Both give the same tools within the chosen scopes and spend limit.

## Signing in with OAuth

### 1. The client opens a browser

The first time a client calls the server, the server answers that sign-in is required and tells it where to sign in. The client opens a Slicer page in the browser. If you aren't signed in, you sign in first — the same way as in the app: email and password, Google, Apple or VK ID.

### 2. The consent screen

Slicer shows who is asking for access and what it will be able to do:

-   **the app** — the client name and the address the response returns to (domain in large type); clients that registered automatically without a published description are marked "Unverified app";
-   **access** in plain words — "View projects", "Edit projects", "Run montage — spends tokens"; if the client didn't request specific scopes — the **Montage** preset;
-   **spend limit** per month — 200 tokens by default; you can lower it, raise it or remove it;
-   **account** — the email the agent will work under, and a "Switch account" link.

### 3. Allow or deny

**Allow** — the client gets access and can call tools right away. **Deny** — the client gets a refusal and can't do anything.

Check the return address on the consent screen: if you're connecting Claude, it's `claude.ai`; if Cursor — its address or a local address on your computer. An unfamiliar app marked "Unverified" is better denied.

The consent screen opens only in the Slicer web app — an MCP client always sends you to the browser, even if you work in the app for iPhone, iPad or Mac.

### Lifetimes and refresh

-   An access token lives 1 hour; the client refreshes it by itself — no need to sign in again.
-   A refresh token lives 60 days and is replaced on every refresh. If someone tries to use an already replaced refresh token, or to reuse an authorization code (this happens with leaks), Slicer revokes the whole connection — the client will have to sign in again.
-   If a client isn't used for more than 60 days, it will need to sign in again.

### Connected apps

All connections are listed in **Profile** → **Developers** → **Connected apps**: client name, return address, access, limit and spending this month, last use. **Disconnect** revokes access immediately. Connections are also disconnected automatically when the account is deleted or blocked.

## Signing in with an API token

Suits clients where a header can be set in the settings: Claude Code (`--header`), Cursor, VS Code, Codex, Windsurf. How to pass the token in each client — on the [Connecting](https://docs.slicer.media/en/mcp/connect/) page.

-   The token's scopes limit the tools: for example, without `montage:run` the assistant can't start paid AI features, and without `publish` it can't publish videos. It can still edit for free without them.
-   The token's spend limit applies to MCP too.
-   It's best to issue a separate token for the assistant — that way it's easy to revoke without touching other integrations.

| Tools | Required scope |
| --- | --- |
| `get_account` | `account:read` |
| `list_projects`, `get_project`, `get_upload`, `get_transcript`, `get_transcribe_jobs` | `projects:read` |
| `create_project` (an “Edit it myself” project), `create_upload_link`, `import_from_url`, `choose_version`, `cancel_project`, `rename_project`, `delete_project`, `edit_project`, `auto_color`, `set_style`, `export_video` | `projects:write` |
| `create_project` with `mode: "ai"` (AI montage), `remount_project`, `retry_project`, `transcribe_speech`, `ask_assistant`, `translate_captions` | `montage:run` |
| `list_social_accounts`, publishing in `export_video` | `publish` |
| `list_styles`, `estimate_cost`, `search_docs`, `read_doc` | any |

A free “Edit it myself” project needs only `projects:write`; `montage:run` is needed only for the AI montage and other paid AI features, and even with it nothing is charged without a confirmed price ([Security and costs](https://docs.slicer.media/en/mcp/costs/#scopes)).

## For client developers

The Slicer authorization server follows the MCP authorization specification (OAuth 2.1). A client only needs the MCP server URL — everything else is discovered automatically:

| Step | What happens |
| --- | --- |
| Discovery | a request without a token → `401` with `WWW-Authenticate: Bearer resource_metadata="https://api.slicer.media/.well-known/oauth-protected-resource/mcp"` |
| Resource metadata (RFC 9728) | `/.well-known/oauth-protected-resource/mcp` — the resource, the authorization server, scopes |
| Server metadata (RFC 8414) | `/.well-known/oauth-authorization-server` — authorization, token, registration and revocation endpoints |
| Client registration | Client ID Metadata Documents (`client_id` is an https URL of the client's JSON description) or Dynamic Client Registration (`POST /oauth/register`, RFC 7591); public clients only, `token_endpoint_auth_method: none` |
| Authorization | `GET /oauth/authorize`: PKCE `S256` is required, `resource` (RFC 8707) is the MCP server URL, `state`; the response carries `code`, `state` and `iss` (RFC 9207) |
| Tokens | `POST /oauth/token` (form or JSON body): `authorization_code` with `code_verifier`, and `refresh_token` with rotation |
| Revocation | `POST /oauth/revoke` (RFC 7009) |

-   Redirect URIs: `https`, `http://127.0.0.1` or `http://localhost` on any port (RFC 8252), or the app's own scheme. The `javascript:`, `data:` and `file:` schemes are forbidden.
-   Clients with a Client ID Metadata Document are treated as verified; dynamically registered ones are shown as unverified on the consent screen.
-   An authorization code is single-use and lives 10 minutes.
-   An access token (`slc_oat_…`) also works with the REST API `/v1` with the same scopes.
-   An invalid or revoked token gets `401` with `WWW-Authenticate: Bearer resource_metadata="…", error="invalid_token"`. A browser request from an untrusted `Origin` gets `403`.
-   Tool errors come back as a result with `isError: true` and the text `code: message` — for example, a call without the required scope: `insufficient_scope: …`.

## What's next

[Security and costsPrice confirmation and the connection's spend limit.](https://docs.slicer.media/en/mcp/costs/)[Tokens and scopesHow to create an API token.](https://docs.slicer.media/en/api/authentication/)[SecurityHow sign-in, tokens and data are protected.](https://docs.slicer.media/en/security/)