Genaya

The RFC 8414 discovery document of the "Sign in with Genaya" server MCP hosts read before they start a sign-in: where to authorize, exchange a code and revoke, that only the authorization code grant with PKCE S256 is supported, that clients are public (token_endpoint_auth_method none), that a client may identify itself with a Client ID Metadata Document, and the five scopes. registration_endpoint is present only while dynamic client registration is switched on (available on request). Served from memory with Cache-Control public, max-age=300; no credential is needed.

The RFC 9728 document that names the MCP endpoint as the protected resource (https://api.genaya.com/mcp) and points at the authorization server that issues tokens for it. The same document is served at the path form /.well-known/oauth-protected-resource/mcp, which is the resource_metadata URL every 401 challenge on POST /mcp carries. Served from memory with Cache-Control public, max-age=300; no credential is needed.

The token endpoint of "Sign in with Genaya". Accepts application/x-www-form-urlencoded (RFC 6749) or application/json, 16 KB at most. Public clients only: send client_id and never a client_secret or client_assertion (either answers 401 invalid_client). grant_type=authorization_code exchanges the one-time code the consent page returned (gny_ac_..., valid 10 minutes, single use decided inside a transaction). The code_verifier must hash (S256) to the code_challenge the authorize request carried, redirect_uri must be the exact one the code was issued for, client_id must be the client the code was issued to, and resource, when sent, must be https://api.genaya.com/mcp. A mismatch counts an attempt; the fifth burns the code. Mints a one-hour access token (gny_at_...) and, only when offline_access was granted, a 30-day refresh token (gny_rt_...). grant_type=refresh_token rotates the pair. The refresh token is bound to the client_id that received it and to the canonical resource: a refresh from another client or for another resource answers invalid_grant and revokes the whole token family. The immediately previous refresh token replays the same new pair for 30 seconds (the hosts' double refresh); anything older is reuse - the family is revoked, the member is told by email and notification, and the host must sign in again. A connection older than the organization's reconnect interval (default 90 days) answers invalid_grant with "reconnect required". Windows: 5 exchanges a minute per code, 10 refreshes a minute per token family, a 1,000-a-minute ceiling per address - never per client_id, because every Claude customer shares one. An infrastructure failure is answered 503 temporarily_unavailable with Retry-After, never as invalid_grant, so a blip cannot disconnect every customer. Every response carries Cache-Control no-store.

RFC 7009. Either token of a family - the access token or the refresh token - revokes the member's connection and every token issued for it; the member is told by email and notification. Accepts application/x-www-form-urlencoded or application/json. Always answers 200 with an empty object, whatever the token (unknown, already revoked, malformed, or while the connector is switched off), so a host can never retry a revoke into a loop. Members can also revoke any connection in the Genaya app under Settings > Integrations.

RFC 7591 dynamic client registration, for an MCP client that has no Client ID Metadata Document of its own. Available on request: it is switched off by default, the endpoint answers 404 while it is off, and the discovery document omits registration_endpoint - write to help@genaya.com with the client you are building. When on: JSON only, 16 KB at most, 10 registrations a minute per address; redirect_uris must be https or a loopback address (http://localhost/... or http://127.0.0.1/..., any port), application_type is required (web or native), token_endpoint_auth_method must be none, and the returned client_id starts with dcr_. A registered client always renders as "Unverified app" on the consent page and needs an organization that allows "Other" assistants; a registration that never authorizes is purged after 90 days unused.