Skip to main content
The Meow MCP server has two surfaces. Account, payment, card, and bill tools are on the OAuth surface, mcp.meow.com. The onboarding surface, mcp.meow.com/cli, serves signup and onboarding tools only. An assistant can never do more than your role and granted permissions allow.

​
OAuth surface (mcp.meow.com)

Sign in once with your Meow login. The server runs OAuth 2.1 with PKCE and sits in front of Meow’s identity provider as an authorization proxy, so your MCP client never talks to that provider directly.

​
The connection flow

1

Client registers and requests access

Your MCP client discovers the server’s metadata, registers, and opens the authorization URL with PKCE and the meow.* scopes it wants.
2

You approve the connection

A Meow consent screen shows which client is connecting. Approve it to continue to sign-in.
3

You sign in

Authenticate with your Meow credentials or Google. This step confirms who you are; what you can do is decided separately, in the next step.
4

You choose what to share

A scope picker appears after sign-in, so it can hide permissions your role could never use. Pick the scopes to grant.
5

Client receives a token

The client exchanges its authorization code, together with the PKCE verifier, for an access token and starts calling tools.

​
Choose what to share

The scope picker appears after you sign in. meow.read is always granted. The rest are opt-in, and each one only shows up if your role can actually use it.
Granting a write scope never bypasses your role. Permissions are re-checked per entity on every call, so someone who is an admin on one entity and a viewer on another sees the write option but can only use it where their role allows.

​
What’s enforced on every call

Each tool call is validated on its own. A valid token alone is never enough. The server checks that:
  • the access token is genuine and was issued for this server;
  • your role allows the action on the target entity;
  • you granted the matching OAuth scope at connect time;
  • the entity is active;
  • the session has not been revoked;
  • any MFA requirement is satisfied.
The permission that actually applies is the intersection of your role and the scopes you granted, so the narrower of the two always wins.

​
Revoking access

You can disconnect an assistant at any time from Developers > MCP Sessions in the Meow dashboard. Revocation is immediate: existing tokens stop working on their next call, and reconnecting starts a fresh OAuth flow. Clients can also revoke their own grant through the server’s /revoke endpoint.

​
Meow CLI

The Meow CLI (@joinmeow/cli, Node.js 24 or later) signs in with the same OAuth flow as MCP clients. It registers as Meow CLI, without a client secret.
  • meow login opens your browser. Sign in, complete MFA, and pick your permissions on the consent screen. An account command also starts sign-in when you have no valid session.
  • Account commands use the same tools and scopes as the OAuth surface. The CLI refreshes your session automatically.
  • meow logout revokes the session on the server, then clears your local credentials. If revocation fails, run it again.
  • meow logout --local clears local credentials only. It does not revoke server access. Use it when the saved credentials are damaged or expired. First revoke Meow CLI in Developers > MCP Sessions.
  • meow onboarding start opens a new account. Run meow onboarding --help for the other onboarding commands.
The CLI stores credentials in the macOS Keychain, Windows Credential Manager, or Linux Secret Service. Unlock the credential store before you sign in. On Linux, you need a running Secret Service, such as GNOME Keyring or KWallet. The CLI never falls back to plaintext files. The sign-in callback listens on a random 127.0.0.1 port. Your browser must reach the machine that runs the CLI. The CLI has no device-code or unattended sign-in.
Earlier CLI versions used API keys. Run meow login once to sign in again. Move onboarding commands under meow onboarding.

​
Onboarding surface

The onboarding surface, https://mcp.meow.com/cli, serves signup, guidance, and onboarding tools only. Use it for agent-led signup. It has no account, payment, card, or bill tools.
  • You verify your email with a six-digit code. The assistant then calls issue_onboarding_key to get an onboarding key.
  • An onboarding key is valid for 7 days and works only with onboarding tools.
  • You can get an onboarding key only while the business is onboarding or under review. An approved business with an active account can’t get one.
  • The server rejects an onboarding key once your membership in the business ends.
  • An onboarding key never gains account permissions, even after the business is approved.
There is no API-key or headless path to account tools over MCP. For account access, connect an MCP client to https://mcp.meow.com, or run meow login in the Meow CLI.

​
Scopes

OAuth meow.* scopes map onto the scopes you already know from the REST API:

​
Next steps

Tool reference

See which scope each tool requires.

Security & trust

The human-in-the-loop model and auditability.