Microtransponder Authentication

generated: '2026-08-26'
method: probed
source: >-
  https://www.mobia.com/.well-known/oauth-authorization-server +
  https://www.mobia.com/.well-known/oauth-protected-resource + observed 401 responses on
  https://www.mobia.com/wp-json/
note: >-
  Derived entirely from documents the host actually served and responses actually
  observed. The company publishes no authentication documentation of its own — there is
  no developer portal — so nothing here comes from prose.
api: Mobia Medical Site REST API (WordPress)
schemes:
- id: anonymous_read
  type: none
  applies_to: >-
    GET on the public wp/v2 collections (posts, pages, media, news, team, categories,
    tags, search, types, taxonomies) and the REST root at /wp-json/
  evidence: GET https://www.mobia.com/wp-json/wp/v2/news?per_page=2 -> 200
- id: oauth2
  type: oauth2
  flow: authorization_code
  pkce: S256
  applies_to: https://www.mobia.com/wp-json/mcp/mcp-oauth-server
  issuer: https://www.mobia.com
  authorization_endpoint: https://www.mobia.com/oauth/authorize
  token_endpoint: https://www.mobia.com/oauth/token
  revocation_endpoint: https://www.mobia.com/oauth/revoke
  response_types_supported:
  - code
  grant_types_supported:
  - authorization_code
  - refresh_token
  token_endpoint_auth_methods_supported:
  - none
  client_id_metadata_document_supported: true
  bearer_methods_supported:
  - header
  scopes:
  - mcp
  evidence: https://www.mobia.com/.well-known/oauth-authorization-server -> 200
- id: wordpress_credentialed
  type: http
  scheme: cookie-or-application-password
  applies_to: >-
    All wp/v2 write operations, /wp-abilities/v1/.../run, and
    /wp-json/mcp/mcp-adapter-default-server
  evidence: >-
    POST https://www.mobia.com/wp-json/mcp/mcp-adapter-default-server ->
    401 {"code":"rest_forbidden"}
  note: >-
    WordPress core authentication (login cookie + X-WP-Nonce, or an Application Password
    over HTTP Basic). Not documented by the provider; inferred from the standard
    WordPress error contract returned by this host.
cors:
  allow_headers:
  - Authorization
  - X-WP-Nonce
  - Content-Disposition
  - Content-MD5
  - Content-Type
  expose_headers:
  - X-WP-Total
  - X-WP-TotalPages
  - Link
  evidence: observed on GET https://www.mobia.com/wp-json/wp/v2/news
docs: null
docs_note: The provider publishes no authentication reference page.