iterate | mock oauth interactive guide

Walk through the OAuth 2.1 flow step by step. This is what happens behind the scenes when an MCP client connects to an OAuth server. Each step unlocks after you complete it.

step 1: server discovery

GEThttps://mock-staging.iterate.com/.well-known/oauth-authorization-server

First, the client discovers what the server supports.

step 2: client registration

POSThttps://mock-staging.iterate.com/oauth/register

redirect uri

step 3: authorization

GEThttps://mock-staging.iterate.com/oauth/authorize

POSThttps://mock-staging.iterate.com/oauth/authorize

Request authorization from a user. You'll see a consent page where users can approve access.

query parameters (GET)

parameter	description
`client_id`	OAuth client ID (required)
`redirect_uri`	Callback URL (required)
`state`	CSRF protection token (required)
`code_challenge`	PKCE challenge (required)
`auto_approve`	Set to `true` to skip consent and auto-generate user
`auto_approve_email`	Email for programmatic auth (requires password)
`auto_approve_password`	Password for programmatic auth (requires email)
`expires_in`	Token expiration in seconds (optional, default: no expiration)

form fields (POST - consent page)

field	description
`action`	`auto` (generate user) or `login` (email/password)
`email`	Email (required when `action=login`)
`password`	Password (required when `action=login`)

step 4: token exchange

POSThttps://mock-staging.iterate.com/oauth/token

Exchange the authorization code for an access token.

step 5: you're done!

GET/POSThttps://mock-staging.iterate.com/oauth

That's the complete OAuth flow. MCP clients do all of this automatically—you just experienced what happens behind the scenes.

Building your own MCP client? Use our mock MCP for testing.

reference

no-auth endpoint

GET/POSThttps://mock-staging.iterate.com/no-auth

bearer endpoint

GET/POSThttps://mock-staging.iterate.com/bearer

Simple endpoint with no authentication.

other endpoints

GEThttps://mock-staging.iterate.com/

Server information

GEThttps://mock-staging.iterate.com/health

JSON health check

user persistence