Skip to content
Whats91

Register an OAuth 2.1 client, complete the PKCE authorization flow, and obtain a scoped Whats91 MCP access token.

Connect and Authorize

Summary

Register an OAuth 2.1 client, complete the PKCE authorization flow, and obtain a scoped Whats91 MCP access token.

Prerequisites

  • A Whats91 account
  • A generated public API token

Related documentation

MCPProtocolScopesSafety and Approvals

Whats91 MCP uses OAuth 2.1: authorization code grant with PKCE, refresh tokens, and optional dynamic client registration. Access tokens are bound to one Whats91 tenant and carry only the scopes the customer consented to.

Discovery

Both standard discovery documents are served, so a compliant MCP client can bootstrap without hard-coded endpoints.

DocumentPath
Protected resource metadataGET /.well-known/oauth-protected-resource
Protected resource metadata (MCP scoped)GET /.well-known/oauth-protected-resource/mcp
Authorization server metadataGET /.well-known/oauth-authorization-server
Authorization server metadata
{
  "issuer": "https://graph.whats91.com",
  "authorization_endpoint": "https://graph.whats91.com/mcp/oauth/authorize",
  "token_endpoint": "https://graph.whats91.com/mcp/oauth/token",
  "registration_endpoint": "https://graph.whats91.com/mcp/oauth/register",
  "revocation_endpoint": "https://graph.whats91.com/mcp/oauth/revoke",
  "response_types_supported": ["code"],
  "grant_types_supported": ["authorization_code", "refresh_token"],
  "code_challenge_methods_supported": ["S256"],
  "client_id_metadata_document_supported": true
}

Note

Only the code response type and the authorization_code and refresh_token grants are supported. S256 is the only PKCE challenge method.

Endpoints

MethodPathPurpose
POST/mcp/oauth/registerDynamic client registration.
GET/mcp/oauth/authorizeStart the authorization code flow; redirects to the Whats91 consent screen.
POST/mcp/oauth/tokenExchange an authorization code, or refresh an access token.
POST/mcp/oauth/revokeRevoke an access or refresh token.

Register a Client

Dynamic client registration
curl -X POST "https://graph.whats91.com/mcp/oauth/register" \
  -H "Content-Type: application/json" \
  -d '{
    "client_name": "Acme Assistant",
    "redirect_uris": ["https://assistant.example.com/oauth/callback"],
    "grant_types": ["authorization_code", "refresh_token"],
    "response_types": ["code"],
    "token_endpoint_auth_method": "client_secret_basic",
    "scope": "mcp:connect mcp:tools:diagnostics mcp:reports:read"
  }'
201 Created
{
  "client_id": "w91_mcp_client_xxxxxxxxxxxxxxxxxxxxxxxx",
  "client_secret": "w91_mcp_secret_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "redirect_uris": ["https://assistant.example.com/oauth/callback"],
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"]
}

Warning

Store client_secret immediately and server-side. Register with token_endpoint_auth_method: "none" for a public client, in which case no secret is issued and PKCE is the only client proof.

Authorize and Exchange

Authorization request
GET https://graph.whats91.com/mcp/oauth/authorize
  ?response_type=code
  &client_id=w91_mcp_client_xxx
  &redirect_uri=https://assistant.example.com/oauth/callback
  &scope=mcp:connect mcp:reports:read mcp:templates:read
  &state=opaque-state
  &code_challenge=BASE64URL-SHA256-OF-VERIFIER
  &code_challenge_method=S256
Token exchange
curl -X POST "https://graph.whats91.com/mcp/oauth/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "w91_mcp_client_xxx:w91_mcp_secret_xxx" \
  -d "grant_type=authorization_code" \
  -d "code=AUTHORIZATION-CODE" \
  -d "redirect_uri=https://assistant.example.com/oauth/callback" \
  -d "code_verifier=ORIGINAL-VERIFIER"

Tip

The customer sees and approves the requested scopes on the Whats91 consent screen. Request the smallest set your client actually uses; unrequested tools simply do not appear in tools/list.

Using the Token

MCP request headers
POST /mcp HTTP/1.1
Host: graph.whats91.com
Authorization: Bearer <mcp-access-token>
Content-Type: application/json
Accept: application/json, text/event-stream
MCP-Protocol-Version: 2025-11-25
  • Bearer tokens must be sent in the Authorization header; no query-string fallback exists on MCP.
  • A 401 response carries a WWW-Authenticate challenge pointing at the protected-resource metadata.
  • Authorization is rate limited to 10 requests per minute per IP; the token and revoke endpoints allow 60 per minute.

Related Documentation

MCP

Connect an AI assistant to Whats91 through the Model Context Protocol and give it safe, scoped access to your WhatsApp workspace.

Protocol

The JSON-RPC methods the Whats91 MCP endpoint implements, protocol negotiation, and transport rules.

Scopes

Every Whats91 MCP OAuth scope, what it unlocks, and how to choose a minimal set.

Safety and Approvals

The six safety classes, the prepare and confirm pattern, idempotency, approvals, and audit behaviour.