> ## Documentation Index
> Fetch the complete documentation index at: https://docs.echozero.app/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth 2.1 authorization endpoint

> Authorization-code + PKCE endpoint for AI assistant clients. Accepts a user JWT via Authorization bearer or local consent form.



## OpenAPI

````yaml https://mcp.echozero.app/api/docs-json get /oauth/authorize
openapi: 3.0.0
info:
  title: EchoZero MCP API
  description: >-
    EchoZero MCP Server - Developer API for agent management, trading,
    marketplace, and AI chat.


    **Rate Limiting:** All endpoints enforce per-API-key rate limits. Tiers:
    free (60 req/min), standard (300 req/min), premium (1000 req/min). Every
    response includes `X-RateLimit-Limit`, `X-RateLimit-Remaining`,
    `X-RateLimit-Reset` headers. Exceeding the limit returns `429 Too Many
    Requests` with a `Retry-After` header.
  version: '1.0'
  contact: {}
servers:
  - url: https://mcp.echozero.app
    description: Production
security: []
tags:
  - name: MCP Protocol
    description: >-
      Model Context Protocol (Streamable HTTP): `/mcp`, `/mcp/sse` — not under
      `/api`; same API key as REST
  - name: Health
    description: Server health check
  - name: API Keys
    description: API key generation, listing, and revocation
  - name: User
    description: >-
      User profile, sessions, social, onboarding, internal agent subscriptions,
      and bot activations (v1: /v1/users/me)
  - name: Token
    description: Token data and trending
  - name: Trade
    description: Trade execution and history
  - name: Strategy
    description: Strategy (trading bot) configuration and control
  - name: Agent
    description: Agent registration and management
  - name: AI
    description: AI chat, intent, and insights
  - name: Wallet
    description: Wallet operations, deposits, and withdrawals
  - name: Notification
    description: Notification management and settings
  - name: Auth
    description: >-
      Public authentication: signup / login lookup, code verification, Google
      OAuth, refresh, and sign-out. Returns `accessToken` / `refreshToken` in
      the JSON body.
  - name: OAuth
    description: >-
      OAuth 2.1 authorization-code + PKCE for AI assistant clients:
      `/oauth/authorize`, `/oauth/token`, `/oauth/introspect`, `/status`.
  - name: Activity
    description: User trade activity list and search
  - name: Feed
    description: Social activity feed timeline
  - name: Earn
    description: Leaderboard, rewards, and referrals
  - name: Statics
    description: Countries, languages, and static data
  - name: Misc
    description: File uploads and utility endpoints
  - name: Developer
    description: Developer registration and profile
  - name: Developer dashboard
    description: >-
      Per-agent dashboard: subscribers (anonymized), performance detail, signal
      history (v1)
  - name: Developer Agent
    description: Developer agent listings and management
  - name: Developer Agents (Marketplace)
    description: Public browse, search, and subscribe to external developer-listed agents
  - name: Admin
    description: Admin-only endpoints for review, approval, and platform management
  - name: Webhooks
    description: >-
      Inbound provider webhooks (no API key). Telegram signal-bot uses
      `X-Telegram-Bot-Api-Secret-Token` when configured.
paths:
  /oauth/authorize:
    get:
      tags:
        - OAuth
      summary: OAuth 2.1 authorization endpoint
      description: >-
        Authorization-code + PKCE endpoint for AI assistant clients. Accepts a
        user JWT via Authorization bearer or local consent form.
      operationId: McpOAuthController_authorize
      parameters:
        - name: response_type
          required: true
          in: query
          schema:
            type: string
            example: code
        - name: client_id
          required: true
          in: query
          schema:
            type: string
            example: echozero-cli
        - name: redirect_uri
          required: true
          in: query
          schema:
            type: string
            example: http://127.0.0.1:8765/callback
        - name: scope
          required: true
          in: query
          description: Space-delimited OAuth scopes mapped to MCP API scopes.
          schema:
            example: read:agents read:strategies write:agents
            type: string
        - name: state
          required: true
          in: query
          schema:
            type: string
        - name: code_challenge
          required: true
          in: query
          schema:
            type: string
        - name: code_challenge_method
          required: true
          in: query
          schema:
            type: string
            example: S256
        - name: access_token
          required: false
          in: query
          description: >-
            User JWT access token for browserless/local flows. Prefer
            Authorization: Bearer in API clients.
          schema:
            type: string
        - name: x-signature
          in: header
          required: false
          description: >-
            HMAC-SHA256 signature: HMAC-SHA256(secretKey, timestamp + METHOD +
            path + body). Optional -- when omitted, HMAC verification is
            skipped.
          schema:
            type: string
        - name: x-timestamp
          in: header
          required: false
          description: >-
            Request timestamp in epoch milliseconds. Required when x-signature
            is provided. Rejected if drift exceeds 5 minutes.
          schema:
            type: string
      responses:
        '200':
          description: ''

````