---
title: "OAuth for third-party clients"
description: "Self-service client registration with PKCE, so an app can ask for access properly."
url: "https://openemail.uk/docs/knowledge/agents/oauth"
area: "Knowledge base"
category: "Agents, API & MCP"
status: "soon"
---

# OAuth for third-party clients

Self-service client registration with PKCE, so an app can ask for access properly.

## Not yet

> Consent and revocation are here; scope is not, so a token reaches your whole mailbox rather than the part an app asked for.

## Details

- Half shipped. Consent and revocation are here: a request is shown to you before it is granted, naming the app and the address your access would be sent to, and Account → Connected apps takes it back. What is missing is the scope: a token reaches your whole mailbox rather than the part of it an app asked for, so granting is still all-or-nothing.
- The mechanism underneath is real, and is what the MCP server authenticates with: a client registers itself, is issued an access token, and the discovery document is served at /.well-known/oauth-authorization-server.