Skip to main content

Authentication & OAuth

2026-10-01 — MCP — sign in with OAuth from Claude, ChatGPT and other MCP clients​

🆕 New

  • POST /oauth/register — Dynamic client registration (RFC 7591) for public MCP clients. Registered clients use the authorization-code flow with PKCE (S256) and refresh tokens with rotation.
  • GET /.well-known/oauth-authorization-server now advertises the authorization_endpoint, registration_endpoint, the grantable company scopes and code_challenge_methods_supported: ["S256"].
  • GET /.well-known/oauth-protected-resource/mcp — Protected resource metadata (RFC 9728) for the MCP server.
  • Tokens issued for an MCP connection carry the MCP URL as an additional audience (RFC 8707 resource). Existing client_credentials and token_exchange clients are unaffected.

2026-06-20 — Public API — Initial Release​

🆕 New

First version of the OlaClick Public API is live.

  • API Key authentication via Authorization: Bearer olk_live_... or X-API-Key header
  • Scopes: menu:read, menu:write, orders:read, clients:read, reports:read, webhooks:read, webhooks:write, companies:read