Connect an agent

dev/page MCP

Connect and authenticate

Every client connects directly to https://www.devpage.org/api/mcp. Each credential belongs to one user, has a stable default workspace, and rechecks current workspace access on every request.

OAuth

Clients discover the authorization server from the MCP challenge and use authorization code with PKCE S256. Sign in to dev/page, choose the default workspace, review the requested scopes and all-accessible-workspaces consent, and approve. Native clients may reuse a registered loopback callback with a new ephemeral port, and browser sign-in may normalize among localhost, 127.0.0.1, and [::1]. Dev/page restores the registered host before issuing the code; the callback path and query remain exact. Access tokens last one hour; refresh tokens rotate and replay revokes the grant.

API keys

For a generic Streamable HTTP client, open the default workspace's Connect page, create a key, and store it in the client's secure configuration. This workspace only is the safer default; All my accessible workspaces is an explicit opt-in for interactive agents. The secret is shown once.

Workspace selection

Omit workspace to use the stable default. Reuse the effective workspace already established in the chat. When a user names another workspace, call list_workspaces, match an exact returned slug, and pass it to subsequent tools. Every workspace-scoped success confirms that effective workspace, and list_folders returns its folder guidance. Ask the user only when the intended workspace remains ambiguous. Legacy credentials remain restricted to their original workspace.

Changing the workspace selected in the browser does not change an existing MCP connection's default. Reconnect OAuth or replace the API key to choose another default.

Recovery

  • unauthenticated: connect a key or OAuth account.
  • invalid_token or credential_revoked: replace the credential.
  • invalid_request with a redirect mismatch: retry OAuth with the same callback path and query; loopback host aliases and ephemeral ports may vary.
  • audience_mismatch: use the exact canonical endpoint.
  • insufficient_scope: authorize the required scope.
  • revision_conflict: read current source, merge, and retry with a new key.