---
title: Authenticating to MemoryBrain
description: The OAuth chain of MemoryBrain's remote MCP server, for MCP clients and AI assistants.
url: https://memorybrain.ai/auth.md
---

# Authenticating to MemoryBrain

MemoryBrain has one way in: its **remote MCP server** at `https://app.memorybrain.ai/mcp`, over streamable HTTP, protected with OAuth and PKCE (S256). There are no API keys to copy and no client secret to create.

## Discover

Everything is discoverable from one request. An unauthenticated call to the MCP server returns `401` with:

```
WWW-Authenticate: Bearer realm="OAuth", resource_metadata="https://app.memorybrain.ai/.well-known/oauth-protected-resource/mcp", scope="mcp"
```

- Protected resource metadata (RFC 9728): `https://app.memorybrain.ai/.well-known/oauth-protected-resource/mcp`
- Authorization server metadata (RFC 8414): `https://app.memorybrain.ai/.well-known/oauth-authorization-server`

## Register

Dynamic client registration (RFC 7591) at `https://app.memorybrain.ai/oauth/register`. MCP clients such as ChatGPT and Claude do this on their own. Public clients (`token_endpoint_auth_method: none`) with PKCE are supported, and so are client ID metadata documents.

## Sign in

- Authorization endpoint: `https://app.memorybrain.ai/authorize`
- Token endpoint: `https://app.memorybrain.ai/oauth/token`
- Grant types: `authorization_code`, `refresh_token`
- Scopes: `mcp`, `offline_access`

The person signs in with their email and a **6-digit code** sent to that address. During the private beta, only emails approved from the waitlist (`https://memorybrain.ai/#waitlist`) can sign in.

## Revoke

The user can see every app with access and revoke it at `https://app.memorybrain.ai/account`.

## Tested clients

ChatGPT (web) and Claude (web and iPhone). Other MCP clients follow the same standard flow but have not been tested. Setup steps for assistants: `https://memorybrain.ai/agents.md`.