SecretVoice

OAuth 2.1

An authorization server your agents can actually use.

The OAuth deployment behind the MCP server is open to any client. Dynamic client registration means nothing to pre-arrange; PKCE means no secrets in a desktop app; resource indicators mean a token minted for one audience cannot be replayed at another.

See the flow Use it over MCP
GET /.well-known/oauth-authorization-server
{ "issuer": "https://secretvoice.dev", "authorization_endpoint": "…/oauth/authorize", "token_endpoint": "…/oauth/token", "registration_endpoint": "…/oauth/register", "code_challenge_methods_supported": ["S256"] }

Endpoints

Five endpoints and two discovery documents.

Everything is discoverable — a client never needs a URL pasted by hand.

EndpointPurposeSpec
POST /oauth/registerDynamic client registrationRFC 7591
GET /oauth/authorizeConsent screenOAuth 2.1
POST /oauth/authorizeApprove or denyOAuth 2.1
POST /oauth/tokenCode and refresh exchangeRFC 6749
POST /oauth/revokeRevocationRFC 7009
discovery
https://secretvoice.dev/.well-known/oauth-authorization-server
https://api.secretvoice.dev/.well-known/oauth-protected-resource

Scopes

Four scopes. Nothing broader than it needs to be.

Ask for the minimum; a token that cannot generate cannot spend your credits.

ScopeGrants
voices:readList voices and languages
tts:generateGenerate audio — this spends credits
history:readRead generation history
account:readRead plan and balance

The flow

Register, authorize, exchange, call.

1 · Register

request
POST /oauth/register
{
  "client_name": "My agent",
  "redirect_uris": ["http://127.0.0.1:33418/callback"]
}
→ 201 { "client_id": "ip…-…" }

2 · Authorize

browser
GET /oauth/authorize?response_type=code
  &client_id=…&redirect_uri=…
  &scope=voices:read%20tts:generate
  &code_challenge=…&code_challenge_method=S256
  &resource=https://api.secretvoice.dev

3 · Exchange

request
POST /oauth/token
grant_type=authorization_code&code=…&client_id=…
&redirect_uri=…&code_verifier=…

→ { access_token, refresh_token, expires_in: 3600, scope }

4 · Call

request
POST https://api.secretvoice.dev/mcp
authorization: Bearer <access_token>

Security

Built for agents that hold a token, not a person at a keyboard.

Questions

Common ones.