Skip to main content
There’s one way in: you sign in to Cohesive. The client handles the OAuth flow, and every tool call afterwards runs under you. The server holds no credential of its own — there’s no identity to fall back on if yours is rejected.

​
The sign-in

The server is its own authorization server, and brokers the real sign-in to Cohesive, so the client never talks to the identity provider directly.
1

The client discovers where to sign in

An unauthenticated request returns 401 with a challenge pointing at the resource metadata, which names the authorization server.
2

You sign in

The client sends you to Cohesive with an authorization code request and PKCE. You approve, and the browser hands you back.
3

The client receives a session

The code is exchanged for an org-scoped access token. Refresh tokens are supported, so a connection outlives a single access token.
Nothing in that sequence asks you for a value to copy. If a client asks you to paste something other than the server URL, it isn’t this flow.

​
What tools actually run under

Your session isn’t what does the work. On each request the server mints a short-lived MCP token from it — your identity, your access to the organization, and a claim marking the session as MCP — and tools run under that. A session that has expired or can’t be verified is refused, and nothing falls back to another identity: acting as you is the whole point.

​
What an MCP session can’t do

The mcp claim withholds credential management. Connected through this server, an agent acting as you can work across your Workspaces, and it cannot:
  • Create, list, or revoke credentials for your account
  • Read or change harness credentials
Everything else is your own access, unchanged. If you can’t reach a Canvas in the app, the agent can’t either.

​
Revocation

End a session and the effect is immediate, not an hour later. When a tool call comes back with an authentication failure, the server drops what it cached for that session, so the next request re-mints — or is refused.

​
Challenges and metadata

An unauthenticated request gets a 401 with a WWW-Authenticate: Bearer realm="cohesive" challenge and a pointer to the resource metadata, which is where a client discovers the authorization server:
An authentication failure inside a tool call comes back differently — as a tool result with exit code 3. See Results.