# Mida auth.md

Mida is an A/B testing and personalization platform. This server (https://mcp.mida.so) is Mida's MCP server: agents use it to create, launch, read and conclude experiments on a person's Mida account.

## Who can connect

Any MCP client or agent acting for a person who has a Mida account. This server has no anonymous access and no identity-assertion (ID-JAG) sign-up: the person signs in and approves the connection.

## A person with no Mida account yet

An agent can create the account through Mida's REST API, with one emailed code. This gives an API key for the REST API, not a token for this MCP server.

1. Show the person https://www.mida.so/terms and ask which email address to register.
2. `POST https://api-us.mida.so/v2/agent/register` with `{"email": "...", "terms_accepted": true, "client": "<your agent name>"}`. Use `https://api-eu.mida.so` for people and sites in the EU; an account cannot change region later. Keep the `claim_token`.
3. Mida emails the person a 6-digit code. Ask them for it.
4. `POST .../v2/agent/claim` with `{"claim_token": "...", "code": "123456"}`. The response carries `api_key` (shown once) and `project_key`.
5. Call the REST API with `Authorization: Bearer <api_key>`. Endpoints: https://docs.mida.so/llms.txt

If no email arrives, the address probably has an account already; Mida gives the same answer either way. To use this MCP server afterwards, the person sets a password at https://app.mida.so/forgot-password and connects as below. They can also sign up themselves at https://app.mida.so/sign-up.

## Registering a client

OAuth 2.1 dynamic client registration (RFC 7591):

- Registration endpoint: https://mcp.mida.so/register
- Send `redirect_uris`, `client_name`, and `token_endpoint_auth_method` (`none` for public clients, or `client_secret_post`).
- A registration expires a year after it was last used. If the token endpoint answers `invalid_client`, register again.

## Getting a token

Authorization code flow with PKCE (S256):

1. Send the person to https://mcp.mida.so/authorize with `response_type=code`, `code_challenge`, `code_challenge_method=S256`, `redirect_uri`, `resource=https://mcp.mida.so/mcp` and a scope.
2. They sign in to Mida, pick the organization and project, and approve the connection.
3. Exchange the code at https://mcp.mida.so/token (`grant_type=authorization_code`, with `code_verifier`).

Scopes:

- `mcp:tools`: every tool the person's Mida role allows.
- `mcp:read`: a read-only connection (read tools plus switching organization or project).

Access tokens last one hour. Refresh tokens (`grant_type=refresh_token`) last 30 days and rotate on use. Revoke with https://mcp.mida.so/revoke.

## Using the token

Send it in the Authorization header on every request to https://mcp.mida.so/mcp (Streamable HTTP):

```
Authorization: Bearer <access_token>
```

Tokens in query strings or form bodies are not accepted.

## Limits on what an agent can do

Experiments are created as drafts. Launching, pausing, concluding, editing a live test, or anything else visitors would see needs the person's explicit confirmation, passed with the tool call. Deletes need an exact confirmation phrase.

## Discovery

- Protected resource metadata: https://mcp.mida.so/.well-known/oauth-protected-resource
- Authorization server metadata: https://mcp.mida.so/.well-known/oauth-authorization-server
- Documentation: https://www.mida.so/mcp