Scratchpad Authentication

generated: '2026-08-13'
method: probed
source: https://mcp.clearskies.cc/.well-known/oauth-authorization-server
docs: https://clearskies.cc/docs/building-with-clearskies/mcp-server
note: >-
  Derived from the live RFC 8414 / RFC 9728 discovery documents rather than an OpenAPI, because
  Scratchpad publishes no OpenAPI. The only authenticated machine surface the company operates is the
  Clearskies remote MCP server; the Scratchpad workspace itself authenticates to Salesforce as an
  OAuth client and inherits Salesforce permissions, but exposes no inbound developer credential.

summary:
  types: [oauth2]
  api_key_in: []
  oauth2_flows: [authorizationCode]
  bearer_methods: [header]
  dynamic_client_registration: true
  pkce_required_methods: [S256]

schemes:
- name: ClearskiesMCPOAuth
  type: oauth2
  applies_to: https://mcp.clearskies.cc/mcp
  sources: [well-known/scratchpad-oauth-authorization-server.json, well-known/scratchpad-oauth-protected-resource.json]
  issuer: https://mcp.clearskies.cc
  flows:
  - flow: authorizationCode
    authorizationUrl: https://mcp.clearskies.cc/oauth/authorize
    tokenUrl: https://mcp.clearskies.cc/oauth/token
    registrationUrl: https://mcp.clearskies.cc/oauth/register
    scopes:
      openid: OpenID Connect subject identifier
      profile: Basic profile claims
      email: Email address claim
  grant_types_supported: [authorization_code, refresh_token]
  response_types_supported: [code]
  code_challenge_methods_supported: [S256]
  token_endpoint_auth_methods_supported: [client_secret_basic, client_secret_post]
  resource_signing_alg_values_supported: [RS256]

protected_resource:
  resource: https://mcp.clearskies.cc
  authorization_servers: [https://mcp.clearskies.cc]
  bearer_methods_supported: [header]
  challenge_observed: >-
    WWW-Authenticate: Bearer realm="mcp", error="invalid_request",
    error_description="missing authorization header",
    resource_metadata="https://mcp.clearskies.cc/.well-known/oauth-protected-resource"

end_user_flow:
  description: >-
    A Claude workspace admin adds Clearskies as a custom connector using the workspace MCP URL from
    app.clearskies.cc/settings/mcp-server; each team member then clicks Connect and authenticates
    against their email domain in the Clearskies app, which completes the OAuth authorization code
    exchange back to the client.
  source: https://clearskies.cc/docs/building-with-clearskies/mcp-clients/claude.md

byok:
  supported: true
  description: >-
    Clearskies workspaces can bring their own AI provider API keys (BYOK) and manage model
    availability. These are outbound model credentials configured in the app, not an inbound
    Clearskies API credential.
  source: https://clearskies.cc/docs/building-with-clearskies/ai-providers.md

x-evidence:
- fetched: '2026-08-13'
  url: https://mcp.clearskies.cc/.well-known/oauth-authorization-server
  http_status: 200
- fetched: '2026-08-13'
  url: https://mcp.clearskies.cc/.well-known/oauth-protected-resource
  http_status: 200
- fetched: '2026-08-13'
  url: https://mcp.clearskies.cc/mcp
  http_status: 401