認証

OAuth 2.1、PKCE、ワークスペース

OAuth 2.1 and PKCE

Supabase Auth is the authorization server. Clients discover protected-resource metadata, dynamically register when supported and complete Authorization Code with PKCE. Passwords and refresh tokens never enter MCP tool handlers.

Two authorization layers

OAuth grant: allows the registered client to obtain and refresh tokens for your BrandSuite user.
BrandSuite grant: binds that client to one workspace, timezone and selected tool groups.

Change or revoke access

Open Account → Security → MCP connections. Revocation blocks the BrandSuite grant first and then removes the OAuth grant. To change workspace, authorize again.

Never paste tokens

Do not put BrandSuite access tokens in prompts or config files. Use the client OAuth flow.