Instasent OAuth API
OAuth 2.1 endpoints — Dynamic Client Registration, the token endpoint, and the discovery metadata that lets a client find them. They exist so a third-party application (or an MCP client) can obtain a Product API token **in the user's name**, instead of asking them to create one in the dashboard and paste it. All of them are anonymous by design: a client has no credential until it completes the flow. These endpoints live at the **API host root**, outside the `/v1` product prefix (`https://api.instasent.com/oauth/token`, not `https://api.instasent.com/v1/oauth/token`), which is why each one declares its own server. The **authorization endpoint is part of this API too**, at `GET /oauth/authorize`. Consent still needs a logged-in user in front of a screen, which only the dashboard can provide, so that endpoint answers `302` and sends the browser to the dashboard's consent screen with the query string untouched. It is served here, on the issuer's own origin, so the whole authorization server is advertised on a single origin: clients that require the authorization endpoint to match the issuer work without special handling. Open it in a browser, then bring the resulting `code` back to `POST /oauth/token`.