`GET /.well-known/oauth-protected-resource/mcp`

OAuth uses S256 PKCE, an exact redirect URI and a separate resource for REST or MCP. Consent is completed in Tong. Refresh tokens rotate on every use.

Request example#

curl 'https://platform.tongai.io/.well-known/oauth-protected-resource/mcp'

Configuration

curl --version

Authentication#

none

Parameters#

No parameters are required.

Request body#

This endpoint has no request body.

Response schema#

Response

JSON

{}

`HTTP 200`

application/json

object

Errors and limits#

HTTP	Error	Recovery
`400`	Invalid request`REQUEST_INVALID`	Correct the fields identified by the error before trying again.
`401`	Invalid credential`CREDENTIAL_INVALID`	Check the credential, its expiry and whether it has been revoked.
`402`	Insufficient credits`INSUFFICIENT_CREDITS`	Add credits to the account that owns the credential, then continue the saved work.
`403`	Permission denied`SCOPE_REQUIRED`	Use a credential with the required scopes and access to the selected resource.
`404`	Resource unavailable`RESOURCE_UNAVAILABLE`	Check the resource ID and that it belongs to the authorized account.
`409`	Intent conflict`IDEMPOTENCY_CONFLICT`	Reuse an intent only with its original request. Use a new UUID for a different action.
`429`	Rate limited`RATE_LIMITED`	Wait for Retry-After before retrying the same intended request.
`503`	Temporarily unavailable`DEPENDENCY_UNAVAILABLE`	Wait for Retry-After and retry with the same intent. Check the saved operation after a timeout.

AuthenticationAPI keys charge the account that owns the key. OAuth lets each connected user use their own credits.Errors and rate limitsUnderstand error responses, retry safely and recover from failed generations.Requests and logsAn accepted request is not a finished generation. Track the saved job until its output is ready.