Skip to main content
The Meow MCP server has two authentication surfaces. Use OAuth for interactive assistants and API keys for the CLI surface. Either way, an assistant can never do more than your role and granted permissions allow.

​
OAuth surface (mcp.meow.com)

Sign in once with your Meow login. The server runs OAuth 2.1 with PKCE and sits in front of Meow’s identity provider as an authorization proxy, so your MCP client never talks to that provider directly.

​
The connection flow

1

Client registers and requests access

Your MCP client discovers the server’s metadata, registers, and opens the authorization URL with PKCE and the meow.* scopes it wants.
2

You approve the connection

A Meow consent screen shows which client is connecting. Approve it to continue to sign-in.
3

You sign in

Authenticate with your Meow credentials or Google. This step confirms who you are; what you can do is decided separately, in the next step.
4

You choose what to share

A scope picker appears after sign-in, so it can hide permissions your role could never use. Pick the scopes to grant.
5

Client receives a token

The client exchanges its authorization code, together with the PKCE verifier, for an access token and starts calling tools.

​
Choose what to share

The scope picker appears after you sign in. meow.read is always granted. The rest are opt-in, and each one only shows up if your role can actually use it.
Granting a write scope never bypasses your role. Permissions are re-checked per entity on every call, so someone who is an admin on one entity and a viewer on another sees the write option but can only use it where their role allows.

​
What’s enforced on every call

Each tool call is validated on its own. A valid token alone is never enough. The server checks that:
  • the access token is genuine and was issued for this server;
  • your role allows the action on the target entity;
  • you granted the matching OAuth scope at connect time;
  • the entity is active;
  • the session has not been revoked;
  • any MFA requirement is satisfied.
The permission that actually applies is the intersection of your role and the scopes you granted, so the narrower of the two always wins.

​
Revoking access

You can disconnect an assistant at any time from the Meow dashboard. Revocation is immediate: existing tokens stop working on their next call, and reconnecting starts a fresh OAuth flow.

​
CLI / API-key surface (mcp.meow.com/cli)

The CLI surface authenticates with a Meow API key sent as a bearer token and scoped to a single entity. Use it for coding agents, automation, and agent-led signup.
  • Create and scope keys from the Meow dashboard. See API key authentication.
  • Use the narrowest scopes the assistant needs. A read-only key can’t draft transfers or issue cards.
  • Never commit a config file that contains an API key. Keep it in a secrets manager or environment variable.
This surface exposes the same read tools as OAuth, plus card, transfer (draft), and billing actions when your key carries those scopes.

​
Scopes

OAuth meow.* scopes map onto the API key scopes you already know from the REST API:

​
Next steps

Tool reference

See which scope each tool requires.

Security & trust

The human-in-the-loop model and auditability.