> ## Documentation Index
> Fetch the complete documentation index at: https://developer.meow.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Meow MCP authentication, OAuth flow, and permission scopes

> How the Meow MCP server authenticates AI assistants: OAuth 2.1 with PKCE, the post-login scope picker, API keys, and what each meow.* scope grants.

The Meow MCP server has two authentication surfaces. Use OAuth for interactive assistants and API keys for the CLI surface. Either way, an assistant can never do more than your role and granted permissions allow.

## OAuth surface (`mcp.meow.com`)

Sign in once with your Meow login. The server runs OAuth 2.1 with PKCE and sits in front of Meow's identity provider as an authorization proxy, so your MCP client never talks to that provider directly.

### The connection flow

<Steps>
  <Step title="Client registers and requests access">
    Your MCP client discovers the server's metadata, registers, and opens the authorization URL with PKCE and the `meow.*` scopes it wants.
  </Step>

  <Step title="You approve the connection">
    A Meow consent screen shows which client is connecting. Approve it to continue to sign-in.
  </Step>

  <Step title="You sign in">
    Authenticate with your Meow credentials or Google. This step confirms who you are; what you can do is decided separately, in the next step.
  </Step>

  <Step title="You choose what to share">
    A scope picker appears after sign-in, so it can hide permissions your role could never use. Pick the scopes to grant.
  </Step>

  <Step title="Client receives a token">
    The client exchanges its authorization code, together with the PKCE verifier, for an access token and starts calling tools.
  </Step>
</Steps>

### Choose what to share

The scope picker appears after you sign in. `meow.read` is always granted. The rest are opt-in, and each one only shows up if your role can actually use it.

| Scope            | Grants                                                                                                   | Shown when                       |
| ---------------- | -------------------------------------------------------------------------------------------------------- | -------------------------------- |
| `meow.read`      | All read access: accounts, balances, transactions, payment networks, contacts, billing, bills, and cards | Always (locked on)               |
| `meow.transfers` | Draft ACH, scheduled ACH, wire, book, and crypto payments                                                | Your role can initiate transfers |
| `meow.cards`     | Issue, update, freeze, and revoke virtual cards                                                          | Your role can manage cards       |
| `meow.billing`   | Create and manage invoicing products, customers, and invoices                                            | Your role can manage billing     |

<Note>
  Granting a write scope never bypasses your role. Permissions are re-checked per entity on every call, so someone who is an admin on one entity and a viewer on another sees the write option but can only use it where their role allows.
</Note>

### What's enforced on every call

Each tool call is validated on its own. A valid token alone is never enough. The server checks that:

* the access token is genuine and was issued for this server;
* your role allows the action on the target entity;
* you granted the matching OAuth scope at connect time;
* the entity is active;
* the session has not been revoked;
* any MFA requirement is satisfied.

The permission that actually applies is the intersection of your role and the scopes you granted, so the narrower of the two always wins.

### Revoking access

You can disconnect an assistant at any time from the [Meow dashboard](https://app.meow.com/signin). Revocation is immediate: existing tokens stop working on their next call, and reconnecting starts a fresh OAuth flow.

## CLI / API-key surface (`mcp.meow.com/cli`)

The CLI surface authenticates with a Meow API key sent as a bearer token and scoped to a single entity. Use it for coding agents, automation, and [agent-led signup](/mcp/connect#agent-led-signup).

* Create and scope keys from the [Meow dashboard](https://www.meow.com/dashboard). See [API key authentication](/authentication).
* Use the narrowest scopes the assistant needs. A read-only key can't draft transfers or issue cards.
* Never commit a config file that contains an API key. Keep it in a secrets manager or environment variable.

This surface exposes the same read tools as OAuth, plus card, transfer (draft), and billing actions when your key carries those scopes.

## Scopes

OAuth `meow.*` scopes map onto the API key scopes you already know from the [REST API](/authentication):

| OAuth scope      | Underlying API key scopes                                                                                                                                   |
| ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `meow.read`      | `accounts:read`, `accounts:balances`, `accounts:transactions`, `accounts:payment_networks`, `contacts:read`, `billing:*:read`, `billpay:read`, `cards:read` |
| `meow.transfers` | `transfers:ach:write`, `transfers:wire:write`, `transfers:book:write`, `transfers:crypto:write`                                                             |
| `meow.cards`     | `cards:write`                                                                                                                                               |
| `meow.billing`   | `billing:invoices:write`, `billing:customers:write`, `billing:products:write`                                                                               |

## Next steps

<CardGroup cols={2}>
  <Card title="Tool reference" icon="wrench" href="/mcp/tools">
    See which scope each tool requires.
  </Card>

  <Card title="Security & trust" icon="shield-check" href="/mcp/security">
    The human-in-the-loop model and auditability.
  </Card>
</CardGroup>