Authorization code with PKCE
Varypilot publishes protected-resource and authorization-server discovery metadata. Compatible clients register through Dynamic Client Registration, then use the authorization-code flow with S256 PKCE. Client metadata documents are not used by this version; choose automatic registration when your client offers a choice.
The exact resource identifier is https://app.varypilot.com/mcp. Clients send it through authorization and token exchange. Redirect URIs must match a registered URI exactly. HTTPS is required except for native loopback callbacks.
Choose the access
Sign in with your Varypilot account, review the requesting client and callback, choose one workspace and select permissions. Read access is required. Draft editing, publishing and administration are separate permissions. Publishing and administration are not preselected.
Only permissions requested by the client and allowed by your current role can be granted. Authorization does not start an experiment or activate a subscription.
Expiry and disconnection
Access tokens expire in one hour. Refresh tokens rotate and expire in thirty days; a connection lasts at most ninety days. Reusing an already consumed refresh token revokes that connection. Reauthorize for additional permissions or another workspace.
Open Connections to revoke a client. Role changes, account restrictions, subscription access and revocation are checked again when tools run.