CorPole Authentication

generated: '2026-11-04'
method: searched
source:
- https://corpole.com/support/reference/oauth-details
- https://corpole.com/support/connect-your-agent/tokens-and-identity
- https://corpole.com/support/connect-your-agent/rest-and-claude-md-fallback
- https://corpole.com/support/troubleshooting/401-invalid-token
docs: https://corpole.com/support/reference/oauth-details
schemes:
- name: oauth2
  type: oauth2
  applies_to: [https://corpole.com/api/mcp]
  flow: authorizationCode
  pkce: S256 (required); public clients
  authorization_server_metadata: /.well-known/oauth-authorization-server (RFC 8414)
  protected_resource_metadata: /.well-known/oauth-protected-resource/api/mcp (RFC 9728)
  client_registration: Dynamic (POST /api/oauth/register, RFC 7591) or Client ID Metadata Documents (an https client_id)
  redirect_uris: https, or http on a loopback address (any port)
  token_lifetime: Access 1 hour, refresh 30 days with rotation; reusing a code or a refresh token revokes the connection
  revocation: POST /api/oauth/revoke (RFC 7009), or Disconnect on the solution's Agents page
  scopes: [read, propose]
- name: personalToken
  type: http
  scheme: bearer
  applies_to: [https://corpole.com/api/mcp, https://corpole.com/api/context]
  description: Personal token for one machine or tool, with an expiry; acts as its owner. Sent as Authorization Bearer. Tokens are shown once and stored only as a hash.
- name: serviceToken
  type: http
  scheme: bearer
  applies_to: [https://corpole.com/api/context, CI change-request check]
  description: Service token for CI (the change-request check and test results); acts as the person with the Integrations permission who created it. Stored as CORPOLE_TOKEN in CI.
notes:
- A connection belongs to one solution and never has more permissions than the person it acts for.
- Anonymous requests to the MCP endpoint get HTTP 401 (pre-flight probe observed 401 at https://corpole.com/api/mcp).